CWE-639
CWE-639 · 850 records · 542 with a public proof-of-concept
Records the NVD classes under CWE-639, highest CVSS first.
- CRITICAL 10CVE-2026-109469
Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.
- CRITICAL 10CVE-2024-34323
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request.
- CRITICAL 9.9CVE-2026-123800public PoC
SuperTokens Core is an open source authentication server. From 6.0.0 until 6.0.24, 7.0.23, 8.0.7, 9.0.6, 9.1.6, 9.2.7, 9.3.5, 10.0.8, 10.1.9, 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, Multitenancy.checkPermissionsForCreateOrU…
- CRITICAL 9.9CVE-2026-17049
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and modify arbitrary documents due to authorization bypass through user-controlled keys.
- CRITICAL 9.9CVE-2026-77366public PoC
obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, an…
- CRITICAL 9.9CVE-2026-94510
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.
- CRITICAL 9.8CVE-2026-120263public PoC
When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account sign-up form looked up the existing account to link by the user name or email submitted in the form instead of the identity asserted by the …
- CRITICAL 9.8CVE-2026-97657
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via Malleable Encryption and Bypassable HMAC in all versions up to, and including, 10.8.0. This is due to the use of MAC-free AES-CTR encryption for cart-recover…
- CRITICAL 9.8CVE-2026-105859public PoC
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents without enforcing coll…
- CRITICAL 9.8CVE-2026-105639public PoC
Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email without an out-of-band ownership check, while User.email is unique=True. The authenticated user can call GET /api/users/me…
- CRITICAL 9.6CVE-2026-77596public PoC
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the multi-user HTTP endpoints POST /apis/v2beta1/pipelines/upload and POST /apis/v2beta1/pipelines/upload_version call canUploadVersionedPipeli…
- CRITICAL 9.6CVE-2026-102940public PoC
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access to the source document, …
- CRITICAL 9.6CVE-2026-105637public PoC
Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using id__in=asset_ids and workspace__slug=slug but does not constrain the query with project_id from the UR…
- CRITICAL 9.6CVE-2026-101084public PoC
obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization checks to access and manipula…
- CRITICAL 9.6CVE-2026-92716public PoC
Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one…
- CRITICAL 9.1CVE-2026-17338
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- CRITICAL 9.1CVE-2026-17292
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to take over ownership of other organizations due to broken object-level authorization. Access checks on organization objects are incomplete, w…
- CRITICAL 9.1CVE-2026-113511
Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.…
- CRITICAL 9.1CVE-2026-117574
A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authoriza…
- CRITICAL 9.1CVE-2026-51879public PoC
deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file. A remote caller can enumerate bot IDs and overwrite another bot's whitelisted control files through the HTTP tutorbot file route.
- CRITICAL 9.1CVE-2026-79537public PoC
metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch. The session store (getSession in session-lifetime-manager.ts) is keyed only by the client-supplied mcp-session-id header with no owner…
- CRITICAL 9.1CVE-2026-93399
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get_form_id', 'bookly_render_complete', 'bookly_add_to_calendar' and 'bookly_rollback_order' AJAX actions. This is due to t…
- CRITICAL 9.1CVE-2026-86934
An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnera…
- HIGH 8.8CVE-2026-17405
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. Access checks on keystore objects do not confirm that the requesting …
- HIGH 8.8CVE-2026-85712public PoC
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the shared project permission check trusted a caller-controlled team_id and let the teamOwner/teamAdmin branch contin…
- HIGH 8.8CVE-2026-88799
The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 do not check ownership or capability on the identifier supplied to their client profile update, allowing any authenticated user, such as a subscriber, to change the password …
- HIGH 8.8CVE-2026-77439public PoC
Immich is a self-hosted photo and video management solution. Prior to 3.0.3, an authenticated user with editor access to a shared album can change the existing owner's role because album member role updates do not protect the owner from modification. By demoti…
- HIGH 8.8CVE-2026-103002public PoC
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster without a resource-level…
- HIGH 8.8CVE-2026-121940public PoC
Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/…
- HIGH 8.8CVE-2026-120461public PoC
Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can s…
- HIGH 8.8CVE-2026-120460public PoC
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control con…
- HIGH 8.8CVE-2026-116672public PoC
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticate_client and ClientConfigurationEndpoint.check_permission reference implementations look up a target client …
- HIGH 8.8CVE-2026-115748
**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions. Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to …
- HIGH 8.8CVE-2026-116068public PoC
Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, update…
- HIGH 8.8CVE-2026-105040public PoC
The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user can set another account's identifier and take over that account.
- HIGH 8.8CVE-2026-70185
Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally.
- HIGH 8.8CVE-2026-110238public PoC
Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify or delete arbitrary user accounts through the UsersModalEditEmbed Livewire component. Attacke…
- HIGH 8.8CVE-2026-89199
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrat…
- HIGH 8.8CVE-2026-19083
Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects OctoCloud: from 1.12.06 before 1.1…
- HIGH 8.8CVE-2026-102406
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user or team sharing the same Kibana deployment, not a separate Elastic Cloud organization or customer. Kib…
- HIGH 8.8CVE-2026-96451
Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.
- HIGH 8.8CVE-2026-100679public PoC
stoatchat before 0.15.5 fails to validate that MFA tickets belong to the authenticated user, allowing attackers to bypass MFA by using their own valid ticket with another user's session token. Attackers can obtain a ticket from their own account and use it wit…
- HIGH 8.8CVE-2026-100670public PoC
Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by a `security@: admin.super` guard that is resolved by the field's exact path, so a submitted flat dot-notation key such …
- HIGH 8.8CVE-2026-100614public PoC
Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mutable database rows without validating ownership. An authenticated attacker can place a victim tenant's image key in a ro…
- HIGH 8.8CVE-2026-86678
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions.
- HIGH 8.8CVE-2026-47094public PoC
SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the emplo…
- HIGH 8.8CVE-2026-84860
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomai…
- HIGH 8.7CVE-2026-55610public PoC
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and over…
- HIGH 8.6CVE-2026-111767public PoC
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryT…
- HIGH 8.5CVE-2026-17388
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- HIGH 8.5CVE-2026-17381
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys.
- HIGH 8.5CVE-2026-17334
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization via user-controlled keys.
- HIGH 8.5CVE-2026-17293
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify user profile information due to broken object-level authorization. Access checks do not confirm that the user is permitted to change …
- HIGH 8.5CVE-2026-122308public PoC
Kyverno before 1.19.2 contains an authorization bypass vulnerability in the Generation Handler that allows users with create/update permissions to trigger synchronized generate policies by spoofing internal generate.kyverno.io labels. Attackers can label a Con…
- HIGH 8.5CVE-2026-116239public PoC
In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log in by username alone, or…
pgadmin 4
- HIGH 8.5CVE-2026-61708public PoC
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `POST /api/agent_data_store/upload` in `backend/app/data_store/data_store_routes.py` permits `customer_user` callers to choose `bucket_name…
- HIGH 8.5CVE-2026-59185public PoC
identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete` endpoint in `internal/api/router.go` accepts `installation_i…
- HIGH 8.5CVE-2026-104971public PoC
Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEnd…
- HIGH 8.5CVE-2026-103247public PoC
n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper guard. Attackers with editor access to shared workflows can exploit mismatched node ID and name matching to retain victim c…
- HIGH 8.5CVE-2026-100618public PoC
Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `icon` value, normalizes it, and stores it in public.apps.icon_url without verifying that the image path belongs to the targ…
- HIGH 8.4CVE-2026-109142
When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning exchange in-process and trusts the child identity (child_handle) that the caller put in the parent contact. Nothing che…
- HIGH 8.4CVE-2026-109141
The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied to a CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. It adds a new child CA under any existing CA, …
- HIGH 8.3CVE-2026-121556public PoC
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to rea…
- HIGH 8.3CVE-2026-63338public PoC
IXP Manager is a full-stack web application for managing Internet Exchange Points. Prior to version 7.3.0, an authenticated user can view and edit a resource belonging to another user without authorization. The API-key edit/update path in `ApiKeyController` se…
- HIGH 8.3CVE-2026-59979public PoC
YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's service and PMS task-library/template routes omit organization and permission checks. `authorizeCognito` in `apps/backe…
- HIGH 8.3CVE-2026-115325public PoC
Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows network-scoped users to modify external clients on other networks. Attackers with external client permissions on one network can send PUT requests …
- HIGH 8.3CVE-2026-114068public PoC
Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to block runs belonging to other organizations. Attackers holding any secret API key can supply a victim run ID wit…
- HIGH 8.3CVE-2026-77935public PoC
Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's w…
- HIGH 8.3CVE-2026-107366
IBM Langflow OSS 1.0.0 through 1.12.4 contains three message endpoints that perform no ownership verification. Any authenticated user can bulk-delete another user's messages, overwrite message content to inject malicious prompts, or hijack an entire conversati…
- HIGH 8.3CVE-2026-111908public PoC
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a broken object-level authorization vulnerability in the PUT /api/v3.1/faq/update endpoint, which checks only the global edit_faq permission and does not verify access to the target FAQ. Au…
- HIGH 8.3CVE-2026-111684public PoC
Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device certificates by supplying foreign serials or entity ids. Attackers can call RevokeBySerial, Rev…
- HIGH 8.3CVE-2026-111680public PoC
APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app i…
- HIGH 8.3CVE-2026-94497public PoC
jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read, modify, and delete other users' business objects by submitting direct object identifiers without aut…
- HIGH 8.3CVE-2026-71242public PoC
Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of …
- HIGH 8.3CVE-2026-55739public PoC
Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). CustomerPolicy's view/update/delete methods omit the company-ownership check entirely, checking only the…
- HIGH 8.2CVE-2026-86442
The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpu…
- HIGH 8.2CVE-2026-102339public PoC
Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC streaming endpoint parses a session ID from the first bytes of a caller-controlled message in pkg/tunnel/message.go and pa…
- HIGH 8.2CVE-2026-71854public PoC
OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be called without authenti…
- HIGH 8.2CVE-2026-108758public PoC
Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appointment by supplying an appointment id without its hash. Attackers can enumerate sequential appointmen…
- HIGH 8.2CVE-2026-76087public PoC
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submission without session …
- HIGH 8.1CVE-2026-119759public PoC
TrailBase 0.28.2 before 0.35.10 contains an insecure direct object reference vulnerability that allows authenticated attackers to manipulate the object-store id metadata within std.FileUpload columns without ownership validation during insert and update operat…
- HIGH 8.1CVE-2026-124471public PoC
OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and b…
- HIGH 8.1CVE-2026-124459public PoC
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such a…
- HIGH 8.1CVE-2026-124447public PoC
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsitePortalActivityController::Update() that checks the request's patientId instead of the stored record's owner. Authenticated portal patients can send PUT requests to the ons…
- HIGH 8.1CVE-2026-17321
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to delete or overwrite arbitrary control-plane assets due to an insecure direct object reference.
- HIGH 8.1CVE-2026-58273public PoC
Rucio is a scientific data management framework. From 1.16.1 until 35.9.0, 38.6.0, and 41.0.0rc1, the /credentials/signurl endpoint reads X-Rucio-Account instead of the account stored in request.environ['issuer'] by token authentication. Any authenticated low-…
- HIGH 8.1CVE-2026-16304
The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship o…
- HIGH 8.1CVE-2026-61671public PoC
WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `extract($_REQU…
- HIGH 8.1CVE-2026-85749public PoC
MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user, D/domain-admin, and H/host roles, can release to inbox or permanently delete the quarantined mail of any other user or d…
- HIGH 8.1CVE-2026-115546
Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session can modify the authentication source parameter, which may generate a SAML assertion granting access to the Admin Console…
- HIGH 8.1CVE-2026-114078public PoC
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows authenticated users to delete or disable other organizations' schedules. Attackers can send delete or disable ac…
- HIGH 8.1CVE-2026-114066public PoC
Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they do not own by supplying a foreign parentRunId to batch-creation endpoints. Attackers can send requests to POST /…
- HIGH 8.1CVE-2026-77937public PoC
Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-asserted user_id HTTP header. Attackers can set user_id to another tenant's ID, even with LETTA_SERVER_SECURE enabled, t…
- HIGH 8.1CVE-2026-109431
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling sing…
- HIGH 8.1CVE-2026-61726public PoC
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sh…
- HIGH 8.1CVE-2026-111722public PoC
LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, P…
- HIGH 8.1CVE-2026-111605public PoC
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH file permissions in any …
- HIGH 8.1CVE-2026-102986public PoC
Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/assets/v2/anchor/{anchor}/ requires authentication for write operations but does not verify workspace or project members…
- HIGH 8.1CVE-2026-79957
ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request body without verifying that the authenticated token belongs to the requested account (CWE-639). …
- HIGH 8.1CVE-2026-63153public PoC
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that spa…
- HIGH 8.1CVE-2026-110124public PoC
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enume…
- HIGH 8.1CVE-2026-109343public PoC
SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch t…
- HIGH 8.1CVE-2026-109334public PoC
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB heade…
- HIGH 8.1CVE-2026-105411
An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instanc…
- HIGH 8.1CVE-2026-108853public PoC
UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' agent or RAG applications by supplying their appId. Attackers can send requests to DELETE /v1/appspac…
- HIGH 8.1CVE-2026-102876public PoC
SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating …
- HIGH 8.1CVE-2026-82323
Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows Exploitation of Trusted Identifiers. This issue affects Enocta Platform: through 2026-09-28.
- HIGH 8.1CVE-2026-100627public PoC
Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The PUT /bundle endpoint, available to "all" and "write" API keys, dispatches to setChannel, which authorizes with checkPer…
- HIGH 8.1CVE-2026-95655public PoC
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments o…
- HIGH 8.1CVE-2026-48976public PoC
HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifier through UpdateOneID(id) without requiring the record's user ID to match the authenticated user. An…
- HIGH 8.1CVE-2026-48975public PoC
HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/internal/data/repo/repo_maintenance_entry.go use UpdateOneID(id) and DeleteOneID(id) without verifying that…
- HIGH 8.1CVE-2026-48826public PoC
HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1_ctrl_actions.go authorizes POST /v1/actions/wipe-inventory through the global ctx.User.IsOwner value instead of the caller's role in the…
- HIGH 8.1CVE-2026-92469public PoC
zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/{id} endpoint that performs no ownership validation. Authenticated attackers can enumerate file identifiers via GET /files and d…
- HIGH 7.7CVE-2026-17387
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- HIGH 7.7CVE-2026-17383
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.
- HIGH 7.7CVE-2026-17376
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- HIGH 7.7CVE-2026-17375
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization decisions rely on information supplied by the client, which could …
- HIGH 7.7CVE-2026-17374
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- HIGH 7.7CVE-2026-17320
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.
- HIGH 7.7CVE-2026-17318
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
- HIGH 7.7CVE-2026-17283
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- HIGH 7.7CVE-2026-17282
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- HIGH 7.7CVE-2026-17112
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to broken object-level authorization.
- HIGH 7.7CVE-2026-16717
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- HIGH 7.7CVE-2026-16715
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to broken object-level authorization.
- HIGH 7.7CVE-2026-16712
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from other tenants due to improper authorization. Identifiers supplied in requests are not sufficiently checked…
- HIGH 7.7CVE-2026-62856public PoC
FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the polycast/receive endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixe…
- HIGH 7.7CVE-2026-54641public PoC
OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role with…
- HIGH 7.7CVE-2026-103252public PoC
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify a…
- HIGH 7.7CVE-2026-103246public PoC
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attackers can reference arbitrary credential IDs to decrypt and exfiltrate plaintext secrets to attacker-controlled hosts wit…
- HIGH 7.7CVE-2026-100268
In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates
youtrack
- HIGH 7.7CVE-2026-82348public PoC
Authorization Bypass Through User-Controlled Key in Apache Roller 6.1.5 allows an authenticated user with authoring rights on one weblog to read, modify, or delete resources belonging to another weblog through unscoped identifier-based lookups. This affects mu…
- HIGH 7.7CVE-2026-76089public PoC
Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-supplied notification ID…
- HIGH 7.7CVE-2026-93991public PoC
Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access review when the metadata.namespace field selector uses the NotEquals operator. Attackers with namespace…
- HIGH 7.6CVE-2026-17129
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference.
- HIGH 7.6CVE-2026-121945public PoC
CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER. Attackers can enumerate sequential incident ids and use PUT /api…
- HIGH 7.6CVE-2026-119049public PoC
FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToU…
- HIGH 7.6CVE-2026-55382public PoC
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only…
- HIGH 7.6CVE-2026-93678
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
langflow
- HIGH 7.6CVE-2026-100579public PoC
OpenClaw (npm package 'openclaw') before 2026.7.1 incorrectly trusts requester provenance in message.action. In identity-bearing Gateway deployments (authentication modes that honor caller identity and narrower operator scopes), a write-scoped caller can suppl…
- HIGH 7.5CVE-2026-109991
The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.15.0.2 via the 'order-pay (WP query var from /checkout/order-pay/<ID>/)' parameter due to missin…
- HIGH 7.5CVE-2026-62344public PoC
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, the unauthenticated GET /activitypub/trail/{id} and GET /activitypub/comment/{id} endpoints call ActivitypubTrail() and ActivitypubComment() to return full trail and c…
- HIGH 7.5CVE-2026-123834
In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account
- HIGH 7.5CVE-2026-121817
Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify specific parameters to access or operate other users' data and functions.
- HIGH 7.5CVE-2026-120426public PoC
OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files. Attackers can inject a percent-encoded current_user parameter into the file…
- HIGH 7.5CVE-2026-97638
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a u…
- HIGH 7.5CVE-2026-119325
Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter withou…
- HIGH 7.5CVE-2026-111417
A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users.
- HIGH 7.5CVE-2026-116183public PoC
phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete any visitor question by supplying an arbitrary openQuestionID to POST /api/faq/create. Attackers solving the CAPTCHA ca…
- HIGH 7.5CVE-2026-110383
Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elec…
- HIGH 7.5CVE-2026-107762
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. T…
- HIGH 7.5CVE-2026-111702public PoC
ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} o…
- HIGH 7.5CVE-2026-103525
The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.7.0 via the 'order_id + billing_address_id (also shipping_address_id)' parameter…
- HIGH 7.5CVE-2026-110724public PoC
In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and…
- HIGH 7.5CVE-2026-107416
Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.2.
- HIGH 7.5CVE-2026-44084
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following versio…
video station
- HIGH 7.5CVE-2026-103366
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reloa…
- HIGH 7.5CVE-2026-63163public PoC
Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorizatio…
- HIGH 7.5CVE-2026-93746
The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_th…
- HIGH 7.5CVE-2026-105631public PoC
Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member …
- HIGH 7.5CVE-2026-100517
Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 versions.
- HIGH 7.5CVE-2026-100514
Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.
- HIGH 7.5CVE-2026-93882
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.4.8 via the CourseMaterialTemplate::render_material_items() callback exposed on …
- HIGH 7.5CVE-2026-100610public PoC
Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the backing service performs no workspace or ownership validation. getAllUpsertHistory() returns UpsertHistory rows selecte…
- HIGH 7.5CVE-2026-89063
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.1 via the 'conversation_id' parameter due to missing validation on a user controlled k…
- HIGH 7.5CVE-2026-88065public PoC
`tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints (such as `/api/student/{id}/photo` and `/api/course_u…
- HIGH 7.4CVE-2026-113727public PoC
OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while s…
- HIGH 7.4CVE-2026-109394public PoC
Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with…
- HIGH 7.4CVE-2026-77523public PoC
MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path workspace but ModelSerializer.ModelParams loads and saves a Model by id alone without including workspace_id in the query…
- HIGH 7.3CVE-2026-122019public PoC
A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation of the argument user_response leads to authorization byp…
- HIGH 7.3CVE-2026-109116public PoC
A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is the function mysqli_query of the component Order Management. Executing a manipulation of the argument ID can lead to autho…
- HIGH 7.3CVE-2026-100885public PoC
A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http/Middleware/CanInstall.php of the component admin-config-setup API Endpoint. The manipulation results in authorization b…
- HIGH 7.3CVE-2026-97646public PoC
A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This affects an unknown function of the file admin/fun/getStudent.php. This manipulation of the argument sid causes authorization bypass. The…
- HIGH 7.3CVE-2026-96762public PoC
A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation…
- HIGH 7.3CVE-2026-86938
A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated administrator privileges by placing a malicious DLL file in the installer directory. This vulnerability is addressed in FileMa…
- HIGH 7.2CVE-2026-111366public PoC
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/in…
- HIGH 7.2CVE-2026-100612public PoC
Capgo (capgo.app) through version 12.261.0 contains an incomplete access-control fix for the public.sso_providers table. Migration 20260826100000_sso_providers_block_direct_active_insert.sql installs a BEFORE UPDATE guard (enforce_sso_provider_client_update_gu…
- HIGH 7.2CVE-2026-97060public PoC
X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account includi…
- HIGH 7.1CVE-2026-124489public PoC
OpenEMR before 8.3.0 contains a broken access control vulnerability in portal/portal_payment.php that allows low-privilege authenticated users to bypass billing ACL checks by tampering patient identifiers. Attackers can modify the pid and form_pid parameters t…
- HIGH 7.1CVE-2026-124475public PoC
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to modify other patients' settings by supplying an arbitrary setting_patient value. Attackers can insert or over…
- HIGH 7.1CVE-2026-124473public PoC
OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID (sid) belongs to the supplied patient and encounter. Authenticated users with encounters/notes per…
- HIGH 7.1CVE-2026-124453public PoC
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to write settings for other patients. Attackers can modify the setting_patient parameter in a JSON POST request …
- HIGH 7.1CVE-2026-123522public PoC
Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object into a no-op Kanban bucket move. Attackers can set task.id to a victim task and task.project_id to their own…
- HIGH 7.1CVE-2026-17311
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to modify application API subscriptions due to broken object-level authorization.
- HIGH 7.1CVE-2026-17284
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform unauthorized operations in other tenants' environments due to improper validation of client-supplied information. Tenant context is …
- HIGH 7.1CVE-2026-100364public PoC
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The aff…
- HIGH 7.1CVE-2026-121560public PoC
LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an en…
- HIGH 7.1CVE-2026-116898public PoC
REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from re…
- HIGH 7.1CVE-2026-114077public PoC
Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by friendlyId alone, without environment, project, or organization scoping. Attackers holding only their own environm…
- HIGH 7.1CVE-2026-113606public PoC
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/…
- HIGH 7.1CVE-2026-112287public PoC
Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, de…
- HIGH 7.1CVE-2026-59963public PoC
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authentica…
- HIGH 7.1CVE-2026-111695public PoC
Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasou…
- HIGH 7.1CVE-2026-111671public PoC
Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in v…
- HIGH 7.1CVE-2026-111607public PoC
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.s…
- HIGH 7.1CVE-2026-111359public PoC
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest…
- HIGH 7.1CVE-2026-55381public PoC
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the ca…
- HIGH 7.1CVE-2026-104875public PoC
Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using on…
- HIGH 7.1CVE-2026-110119public PoC
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /…
- HIGH 7.1CVE-2026-109568public PoC
Shaark 1.2.13 through 1.2.44 contains a missing authorization vulnerability in the Link, Story, Chest and Album API controllers that skips ownership checks. Authenticated non-admin users can send PUT or DELETE requests to /api/{link,story,chest,album}/{id} wit…
- HIGH 7.1CVE-2026-109164public PoC
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterat…
- HIGH 7.1CVE-2026-78023
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to El…
policy manager for secure connect gateway
- HIGH 7.1CVE-2026-107270public PoC
Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST request…
- HIGH 7.1CVE-2026-103009
Authorization Bypass Through User-Controlled Key (CWE-639) in Elasticsearch can lead to Information Disclosure via a specially crafted cross-cluster search request that references an unauthorized shard identifier. Elasticsearch contains an authorization bypass…
elasticsearch
- HIGH 7.1CVE-2026-106100public PoC
Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before 4.0.0-canary.20, an authenticated user who can update a document can modify fields that field-level write access c…
- HIGH 7.1CVE-2026-105761public PoC
Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied ser…
- HIGH 7.1CVE-2026-105633public PoC
Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the database query. A project member can use an issue_id they control in the URL while targeting another user'…
- HIGH 7.1CVE-2026-105629public PoC
Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key lookup without workspace, project, or estimate scoping. An administrator or member of one workspace can per…
- HIGH 7.1CVE-2026-104975public PoC
Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and proj…
- HIGH 7.1CVE-2026-104444public PoC
YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-privilege users to overwrite arbitrary pages or comments by supplying their own page as the pagetag field. Attackers can sen…
- HIGH 7.1CVE-2026-103054public PoC
AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated users to add arbitrary tenants to portfolios they own. Attackers can submit tenant UUIDs via the add_tenants_to_portfolio endpoint to claim …
- HIGH 7.1CVE-2026-93538public PoC
A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display…
- HIGH 7.1CVE-2026-77293public PoC
TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated user against the attacker-controlled tripId but deleteNoteFile in server/src/services/collabService.ts…
- HIGH 7.1CVE-2026-84791
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls…
- HIGH 7.1CVE-2026-84789
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope…
- HIGH 7.1CVE-2026-96271public PoC
Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links for albums owned by other users. Attackers can supply arbitrary album IDs to generate working share …
- HIGH 7.1CVE-2026-94462public PoC
Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsController#associate uses find_cart_for_association to locate a cart by prefixed_id b…
- HIGH 7.1CVE-2026-94535public PoC
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users' notifications. Attackers can call the DELETE /anyone/extendNotice/deleteMyNotice endpoint with arbitr…
- HIGH 7.1CVE-2026-94534public PoC
lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify arbitrary user profiles. Attackers can supply target user IDs in request bodies to rewrite profile fi…
- MEDIUM 6.8CVE-2026-91168public PoC
Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux. From 0.21.0 until 0.29.0, the Kubernetes request correlator in warpgate-protocol-kubernetes/src/correlator.rs keys an authorized AdmittedTarget by username, target_name, and client IP rat…
- MEDIUM 6.8CVE-2026-115706
Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for…
elastic cloud enterprise
- MEDIUM 6.8CVE-2026-115334public PoC
Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POS…
- MEDIUM 6.8CVE-2026-110620public PoC
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. Authenticated owners or managers of any organiza…
- MEDIUM 6.8CVE-2026-104898
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 28.4 via the 'id, wp_user_id' parameter due to missing validation on a user controlled ke…
- MEDIUM 6.8CVE-2026-108110public PoC
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send i…
- MEDIUM 6.8CVE-2026-104964public PoC
Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace slug in the request URL but loads the target project globally by UUID without binding it to that workspace. An administ…
- MEDIUM 6.8CVE-2026-100609public PoC
Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user's workspace (findOneBy({ id: credentialId }) with no workspaceId condition) in several code paths: getAllOpenaiAssistant…
- MEDIUM 6.7CVE-2026-92539
A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organizations on the same Grafana instance through the SCIM API (insecure direct object reference). Only Grafana Enterprise inst…
- MEDIUM 6.5CVE-2026-109801
SAP NetWeaver Application Server Java (NWDI Cockpit)� does not perform sufficient authorization checks for certain functionality that retrieves sensitive information. An attacker with low privileges could send a specially crafted request to access sensitive in…
- MEDIUM 6.5CVE-2026-125365public PoC
DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to modify other users' account balances by supplying foreign account_id values. Attackers can submit sequential account_id, destination_acc…
- MEDIUM 6.5CVE-2026-124485public PoC
OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allows authenticated patients to read other patients' documents by overriding query criteria. Attackers can send empty pid_Equals and denialReaso…
- MEDIUM 6.5CVE-2026-124482public PoC
OpenEMR before 8.4.0 contains an authorization bypass allowing low-privileged SMART standalone-launch users to bind arbitrary patient UUIDs into the OAuth token context. Attackers with only the patients|demo ACL can select a victim during authorization and rea…
- MEDIUM 6.5CVE-2026-124481public PoC
OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, encounter, and amount values instead of deriving them from the portal session. Authenticated portal patients can…
- MEDIUM 6.5CVE-2026-124476public PoC
OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied form_pid (or the patient_id_cc value in Sphere data) to onsite_portal_activity without checking it against the session patient. Authen…
- MEDIUM 6.5CVE-2026-124470public PoC
OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portal_custom_report.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue_ p…
- MEDIUM 6.5CVE-2026-124464public PoC
OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read other patients' questionnaire responses because FhirQuestionnaireResponseService does not implement IPatientCompartmentResourceService. Attacker…
- MEDIUM 6.5CVE-2026-124462public PoC
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to bypass the lowercase pid authorization guard by supplying a capitalised Pid parameter. Attackers c…
- MEDIUM 6.5CVE-2026-124460public PoC
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that allows authenticated patients to read other patients' pending demographic change requests. Attackers can supply another patient's ID in the …
- MEDIUM 6.5CVE-2026-124455public PoC
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query() that allows authenticated portal patients to read other patients' documents by overriding Pid_Equals criteria. Attackers can supply Pid_Equals,…
- MEDIUM 6.5CVE-2026-124449public PoC
OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read routes that skip ACL checks. Non-patient API tokens lacking OpenEMR ACLs can request resources by uuid, bypassing compartment filtering to re…
- MEDIUM 6.5CVE-2026-122085
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not perform authorisation or a valid nonce check on its ticket-transfer feature, which is available to unauthenticated users, allowing them to transfer other attendees' guest-checkout…
- MEDIUM 6.5CVE-2026-93779
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.2 via the init_routes due to missing validation on a user controlled key. This makes it possib…
- MEDIUM 6.5CVE-2026-17307
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- MEDIUM 6.5CVE-2026-17241
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
- MEDIUM 6.5CVE-2026-63437public PoC
2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, the recipients() method in app/Api/v1/Controllers/TwoFAccountShareController.php receives a caller-selected TwoFAccount through Laravel mo…
- MEDIUM 6.5CVE-2026-62852public PoC
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction for users configured to see only assigned conversations. A restricted auth…
- MEDIUM 6.5CVE-2026-89101
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the get_entry due to missing validation on a user …
- MEDIUM 6.5CVE-2026-120474public PoC
undici is an HTTP client for Node.js. In versions 7.0.0 through 7.30.1 and 8.0.0 through 8.12.3, when the redirect interceptor and a shared response cache are used together, an authenticated request that is redirected to a same-origin target has the final resp…
- MEDIUM 6.5CVE-2026-69144public PoC
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, download.php checks authorization against a Documents bean before resolving whether the supplied identifier is a document_revi…
- MEDIUM 6.5CVE-2026-63218public PoC
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the changeReportPage controller action renders a protected report without repeating the record-level access check enforced by …
- MEDIUM 6.5CVE-2026-63217public PoC
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the generatePdf entry point loads an arbitrary record through BeanFactory::getBean() without checking the requesting user's re…
- MEDIUM 6.5CVE-2026-57562public PoC
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionI…
- MEDIUM 6.5CVE-2026-54377public PoC
VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different user_id or profile_id to endpoints such as GET /front/profile/{profile_id…
- MEDIUM 6.5CVE-2026-82029public PoC
Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only company_id scope inste…
- MEDIUM 6.5CVE-2026-119748
The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice()…
- MEDIUM 6.5CVE-2026-122007public PoC
Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an authenticated site administrator to read and modify settings belonging to other sites within the same tenant database by supplying an arbitrary…
- MEDIUM 6.5CVE-2026-110964
The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a self-registered customer-level user to delete other users' media library attachments, including those …
- MEDIUM 6.5CVE-2026-121734public PoC
ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to read another workspace's pending preview environment by querying ReviewPreviewEnvDeployAPIView without project scoping. Attackers can use the…
- MEDIUM 6.5CVE-2026-121582public PoC
A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launch…
- MEDIUM 6.5CVE-2026-116669
Tanium addressed an improper access controls vulnerability in Discover.
discover
- MEDIUM 6.5CVE-2026-119734
Munshi (by Petpooja) before 2026-06-17 contained a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-i…
- MEDIUM 6.5CVE-2026-119732
Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner by exploiting the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bu…
- MEDIUM 6.5CVE-2026-120425public PoC
Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signatu…
- MEDIUM 6.5CVE-2026-62277public PoC
LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, `PrintRecordStickers` in `/Controllers/VehicleController.cs` checks through `CollaboratorFilter` that the authenticated caller can view the suppli…
- MEDIUM 6.5CVE-2026-62991public PoC
Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers` but looks up an arbitrary user ID without applying the `c…
- MEDIUM 6.5CVE-2026-120007public PoC
NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to cl…
- MEDIUM 6.5CVE-2026-55551public PoC
ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management. Prior to 5.2.0, by-id read endpoints in `src/main/kotlin/nl/info/zac/app/zaak/ZaakRestService.kt` omit `assertPolicy`(`policyService.readZaakRechten(zaak).lezen`…
- MEDIUM 6.5CVE-2026-119708public PoC
abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadBy…
- MEDIUM 6.5CVE-2026-119645public PoC
ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body a…
- MEDIUM 6.5CVE-2026-117028public PoC
Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method. An authenticated student can manipulate the studentId parameter to retrieve another student's examination results, includin…
- MEDIUM 6.5CVE-2026-118760public PoC
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who c…
- MEDIUM 6.5CVE-2026-118084
Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.
- MEDIUM 6.5CVE-2026-82411public PoC
Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-d…
- MEDIUM 6.5CVE-2026-116899public PoC
REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions…
- MEDIUM 6.5CVE-2026-116745public PoC
QloApps through 1.7.0 contains an information disclosure vulnerability in OrderConfirmationController::init() that allows unauthenticated attackers to obtain guest order references and emails by supplying guest id_cart values. Attackers can iterate sequential …
- MEDIUM 6.5CVE-2026-113603public PoC
The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid routes by supplying a misma…
- MEDIUM 6.5CVE-2026-112286public PoC
Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read other users' quotes by bypassing per-user data scope checks in QuoteController. Attackers can query the quotes search an…
- MEDIUM 6.5CVE-2026-110070
The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary po…
- MEDIUM 6.5CVE-2026-111912public PoC
Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_sa…
- MEDIUM 6.5CVE-2026-111698public PoC
HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp PayController.xcxRecharge endpoint that allows attackers to modify any member's wallet balance without payment. Attackers can send requests with arbitrary amount a…
- MEDIUM 6.5CVE-2026-111697public PoC
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate sequential member ids a…
- MEDIUM 6.5CVE-2026-111651public PoC
Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allows authenticated users to export any tenant's personnel directory. Attackers can supply another tenant's tenantId to exp…
- MEDIUM 6.5CVE-2026-111649public PoC
Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content…
- MEDIUM 6.5CVE-2026-111615public PoC
Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enumerate auto-increment o…
- MEDIUM 6.5CVE-2026-111614public PoC
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged attackers can enumerate…
- MEDIUM 6.5CVE-2026-54657public PoC
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter resul…
- MEDIUM 6.5CVE-2026-15219
Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosur…
- MEDIUM 6.5CVE-2026-111364public PoC
MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated users to read documents from unauthorized books. Attackers holding a non-observer role on any book can name that book a…
- MEDIUM 6.5CVE-2026-111363public PoC
BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids again…
- MEDIUM 6.5CVE-2026-54683public PoC
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/documentapi/{documentapi}/…
- MEDIUM 6.5CVE-2026-77460public PoC
EspoCRM is an open source customer relationship management application. Prior to 10.0.3, a user with email-template edit access and mass-email sending access can reference restricted record fields in a template because the renderer stops filtering those fields…
- MEDIUM 6.5CVE-2026-102980public PoC
Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project_id from the URL. ProjectPagePermission likewis…
- MEDIUM 6.5CVE-2026-110775public PoC
Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in multi-tenant deployments …
- MEDIUM 6.5CVE-2026-110613public PoC
youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page through the oms_order table using a self-registered account …
- MEDIUM 6.5CVE-2026-85873
Improper authorization in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
- MEDIUM 6.5CVE-2026-110129public PoC
fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate…
- MEDIUM 6.5CVE-2026-110121public PoC
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can send PUT requests to /s…
- MEDIUM 6.5CVE-2026-110118public PoC
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the comp…
- MEDIUM 6.5CVE-2026-102981public PoC
Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the s…
- MEDIUM 6.5CVE-2026-89202
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privileges to disconnect a…
- MEDIUM 6.5CVE-2026-109427public PoC
Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string function…
- MEDIUM 6.5CVE-2026-109329public PoC
Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a f…
- MEDIUM 6.5CVE-2026-109168public PoC
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business objects' file attachments by supplying an arbitrary bizId to the listFileByBizId endpoint. Attackers can retrieve file n…
- MEDIUM 6.5CVE-2026-109166public PoC
lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById ha…
- MEDIUM 6.5CVE-2026-107427
Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
- MEDIUM 6.5CVE-2026-107193
A flaw has been found in **permission filters** in the **foreman** package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged network attacker or user must already be allowed to delete fil…
- MEDIUM 6.5CVE-2026-108547public PoC
AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and dec…
- MEDIUM 6.5CVE-2026-108164public PoC
Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messa…
- MEDIUM 6.5CVE-2026-85571
The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course the requester manages, allowing users with instructor level access to reassign the parent of any post on the site, taki…
- MEDIUM 6.5CVE-2026-108096public PoC
Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated remote user to read records owned by other users of the same application via crafted queries…
- MEDIUM 6.5CVE-2026-10631
An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with EWS enabled to read complete mailbox items, including raw MIME and attachments, from arbitrary local accounts without a s…
- MEDIUM 6.5CVE-2026-106603
Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HollerBox: from n/a through 2.3.14.
- MEDIUM 6.5CVE-2026-94245
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's…
- MEDIUM 6.5CVE-2026-76269
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job identifier to access substantially all search job information from jobs that belong to other u…
- MEDIUM 6.5CVE-2026-46438public PoC
wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's `SlotEntry` by supplying the victim's `slot_entry` ID in a `POST /api/v2/workoutlog/` reques…
- MEDIUM 6.5CVE-2026-105811public PoC
Authorization bypass through a user-controlled key in the optional Amazon Q Business Lambda hook sample ( q-business-lambda-hook https://github.com/aws-solutions-library-samples/qnabot-on-aws/blob/main/source/docs/lambda_hooks/README.md ), available with QnABo…
- MEDIUM 6.5CVE-2026-39756
Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.
- MEDIUM 6.5CVE-2026-32576
Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.2…
- MEDIUM 6.5CVE-2026-105754public PoC
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the /inference/v1/generate endpoint in the disaggregated scale-out path accepts caller-supplied tensors in the features.kwargs_data field, cache identifiers in the features.mm_…
vllm
- MEDIUM 6.5CVE-2026-104969public PoC
Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can add issues from any workspace to a cycle…
- MEDIUM 6.5CVE-2026-104960public PoC
Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspace_slug}/download/{asset_id}/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning …
- MEDIUM 6.5CVE-2026-104449public PoC
YesWiki before 4.6.7 contains an access control vulnerability allowing unauthenticated attackers to overwrite any existing wiki page, including pages whose write ACL restricts editing, via the Bazar entry-creation flow. Attackers can submit a crafted entry wit…
- MEDIUM 6.5CVE-2026-97269
Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.
- MEDIUM 6.5CVE-2026-97251
Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions.
- MEDIUM 6.5CVE-2026-103288public PoC
Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to…
- MEDIUM 6.5CVE-2026-103491
In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues
youtrack
- MEDIUM 6.5CVE-2026-91109
The Simply Schedule Appointments plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.12.31 via the 'complete_group' parameter due to missing validation on a user controlled key. This makes it possibl…
- MEDIUM 6.5CVE-2026-102139public PoC
An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature could read the subje…
- MEDIUM 6.5CVE-2026-96347
Subscriber Insecure Direct Object References (IDOR) in Bookly <= 28.2 versions.
- MEDIUM 6.5CVE-2026-102373
GestSup versions before 3.2.62 fail to validate ticket ownership when loading comments via the threadedit parameter in thread.php. Authenticated attackers can enumerate sequential comment IDs to read private comments from other users' tickets without proper au…
- MEDIUM 6.5CVE-2026-100688public PoC
Budibase server before 3.45.0 contains a cross-tenant information disclosure vulnerability in the GET /api/applications/:appId/appPackage endpoint that allows authenticated users to read another tenant's application metadata and source code. Attackers can supp…
- MEDIUM 6.5CVE-2026-100531public PoC
The @openclaw/slack npm package before 2026.8.1 contains an authorization flaw in its Slack download-file handler: when a file lacks the share metadata used to prove it belongs to the requested conversation, the conversation-authorization check fails open. An …
- MEDIUM 6.5CVE-2026-85291public PoC
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane's Users::change_password() method accepts a user_id from the URL and updates that account's password without an object-level author…
- MEDIUM 6.5CVE-2026-97636public PoC
Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes …
- MEDIUM 6.5CVE-2026-76907public PoC
LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-digit document paths to scope descendant searches without requiring the caller to possess the public d…
- MEDIUM 6.5CVE-2026-84720
A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is ther…
- MEDIUM 6.5CVE-2026-84713
A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configuration is protected from API filtering, its recipient value is copied in clear text i…
- MEDIUM 6.5CVE-2026-95602
Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.
- MEDIUM 6.5CVE-2026-86867
Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in `libs/ktem/ktem/pages/chat/control.py` tha…
- MEDIUM 6.5CVE-2026-80342
The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticate…
- MEDIUM 6.5CVE-2026-16264
The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data a…
- MEDIUM 6.5CVE-2026-75517public PoC
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, update-integration, auto-configure-integration, and set-integration-as-primary look up an integration b…
- MEDIUM 6.5CVE-2026-94533public PoC
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachments. Attackers can retrieve other users' stored files by supplying valid attachment identifiers to th…
- MEDIUM 6.5CVE-2026-94532public PoC
lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user's full profile. Attackers can iterate the userId parameter to harvest sensitive user information inc…
- MEDIUM 6.5CVE-2026-79917public PoC
MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{chat_id}/share_chat verifies that a conversation exists but does not verify that it belongs to the authenticated chat_user_id or to the appl…
- MEDIUM 6.5CVE-2026-55179public PoC
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied int…
- MEDIUM 6.5CVE-2026-61744public PoC
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key, while BarcodeView uses IsAuthenticatedOrReadScope and …
- MEDIUM 6.5CVE-2026-92605public PoC
IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers with access to any single case can enumerate sequential object identifiers and read comment threads fro…
- MEDIUM 6.5CVE-2026-92603public PoC
ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the Ids…
- MEDIUM 6.5CVE-2026-92567public PoC
TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers alloc…
- MEDIUM 6.5CVE-2026-92468public PoC
zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to read any Elasticsearch index by specifying the index name in POST /search/{indexName} and GET /agg/r…
- MEDIUM 6.5CVE-2026-86465public PoC
Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag author scoped to one team can supply a Variable key containing a path separator that causes the back…
apache-airflow-providers-akeyless
- MEDIUM 6.5CVE-2026-71251public PoC
Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) fetched the requested Media record by ID with no verification that it belonged to the requesting porta…
- MEDIUM 6.5CVE-2026-11454
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.2 via the GET /wp-json/gh/v4/contacts/<id> REST endpoint. The endpoint's permission cal…
- MEDIUM 6.4CVE-2026-17236
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Authorization checks are not applied when certain organization URLs are resolved…
- MEDIUM 6.4CVE-2026-115804
HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may allow an authenticated user to modify health checks belonging to another service on the same node. This vulnerability (CVE-2026-115804) is fi…
- MEDIUM 6.4CVE-2026-111368public PoC
ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows course tutors or admins to modify submissions in other courses. Attackers can supply their own course id with another cour…
- MEDIUM 6.4CVE-2026-109194
A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view,…
- MEDIUM 6.4CVE-2026-83805public PoC
Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does not enforce approver-group membership, change permission on the object under review, or the one-respon…
- MEDIUM 6.3CVE-2026-17391
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- MEDIUM 6.3CVE-2026-121583
A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradePaymentService.java. The manipulation of the ar…
- MEDIUM 6.3CVE-2026-120319
A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccm…
- MEDIUM 6.3CVE-2026-112861
Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database participants-database allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Participants Database: from n/a through 2.7.…
- MEDIUM 6.3CVE-2026-112043public PoC
A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument…
- MEDIUM 6.3CVE-2026-110494public PoC
Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, c…
- MEDIUM 6.3CVE-2026-111703public PoC
yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-open…
- MEDIUM 6.3CVE-2026-111654public PoC
FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, c…
- MEDIUM 6.3CVE-2026-111355public PoC
zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplying out-of-scope record ids. Attackers holding user or organization module permissions with De…
- MEDIUM 6.3CVE-2026-111331public PoC
Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to manage other tenants' ports because the target application's organization is never verified. Att…
- MEDIUM 6.3CVE-2026-110381
Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n…
- MEDIUM 6.3CVE-2026-110125public PoC
Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial num…
- MEDIUM 6.3CVE-2026-109393public PoC
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htl_access hotel checks. Hotel…
- MEDIUM 6.3CVE-2026-94246
The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the wallet account named in a withdrawal submission belongs to the user making it, allowing any authenticated user, such as a subscriber, to file a withdrawal request against…
- MEDIUM 6.3CVE-2026-105171public PoC
A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected by this vulnerability is an unknown functionality of the file admin/admin.php of th…
- MEDIUM 6.3CVE-2026-105096public PoC
A vulnerability was determined in Omega Solution CoinEx Crypto 2025. This affects an unknown function of the file /customer/ of the component Customer Profile API. Executing a manipulation of the argument ID can lead to authorization bypass. The attack may be …
- MEDIUM 6.3CVE-2026-103233public PoC
A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This impacts an unknown function of the file /admin/ of the component Admin Area. Such manipulation of the argument ID lea…
- MEDIUM 6.3CVE-2026-100878public PoC
A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file edu-common/src/main/java/com/edu/common/core/domain/entity/SysUser.java of the component authRole Endpoint. The manipulati…
- MEDIUM 6.3CVE-2026-72662
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user granted the Timeline feat…
- MEDIUM 6.3CVE-2026-97368
A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-system/src/main/java/org/springblade/system/service/impl/UserServiceImpl.java of the component user-auth-i…
- MEDIUM 6.3CVE-2026-69190public PoC
Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner pe…
- MEDIUM 6.3CVE-2026-18818
A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the component Support Ticket Handler. Executing a manipulation can lead to authorization bypass. The att…
- MEDIUM 6CVE-2026-111905public PoC
phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which returns any user's full faquserdata row, including the live TOTP secret, without a SuperAdmin o…
- MEDIUM 6CVE-2026-111365public PoC
cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys…
- MEDIUM 5.9CVE-2026-77442public PoC
Ryot is a self-hosted personal tracking application. Prior to 10.4.0, the createOrUpdateUserIntegration GraphQL mutation in crates/services/user/src/integration_operations.rs allows a low-privileged authenticated user to supply another user's integrationId to …
- MEDIUM 5.9CVE-2026-119421public PoC
Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Attackers holding the merc…
- MEDIUM 5.9CVE-2026-2270public PoC
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full co…
- MEDIUM 5.9CVE-2026-115329public PoC
Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object() that uses an unscoped queryset without organization filtering or permission checks. Authenticated users or API keys from any organization can su…
- MEDIUM 5.9CVE-2026-78433public PoC
Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment'…
- MEDIUM 5.9CVE-2026-110611public PoC
REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can supply another user's chatid to chat-init, chat-d…
- MEDIUM 5.9CVE-2026-102157
An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data.
- MEDIUM 5.9CVE-2026-78371
The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other custo…
- MEDIUM 5.5CVE-2026-111947
The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including pri…
- MEDIUM 5.5CVE-2026-100897
A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639ec7cef620651bfd0f07ebb660529e3f. The impacted element is an unknown function of the file /StudentInfo/StudentHandler/moditypasswordstu of the component Password Change Endpoint. Suc…
- MEDIUM 5.4CVE-2026-125387public PoC
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/as…
- MEDIUM 5.4CVE-2026-125375public PoC
MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sort_data. Attackers owning any…
- MEDIUM 5.4CVE-2026-125373public PoC
IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying sequential primary keys. Attackers can abuse view_feedback_nominee, view_feedback_topic, view_feedba…
- MEDIUM 5.4CVE-2026-123503public PoC
Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete buckets via a mismatched view ID. Attackers can request deletion through another view's bucket endpoint to bypass the las…
- MEDIUM 5.4CVE-2026-123624public PoC
ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify other tenants' fast commands by supplying arbitrary sequential ids to POST /manage/saveFastCommand. Attackers can overwrite another tena…
- MEDIUM 5.4CVE-2026-123329
In JetBrains YouTrack before 2026.2.19562 missing authorization in TeamCity integration allowed disclosure of other projects' actions
- MEDIUM 5.4CVE-2026-88982public PoC
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the legacy V1/raw-Argo execution cache mutating webhook and cache-server storage path hash selected template fields without the Kubernetes name…
- MEDIUM 5.4CVE-2026-118407
The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user to take ownership of any unclaimed guest order, and thereby read the buyer's billing details and downl…
- MEDIUM 5.4CVE-2026-120430public PoC
Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can …
- MEDIUM 5.4CVE-2026-120200public PoC
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, re…
- MEDIUM 5.4CVE-2026-119659public PoC
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated users to access other users' folders because FolderService queries filter only on folder id. Attackers can supply another user's folder id to /folder/info, /folder/…
- MEDIUM 5.4CVE-2026-119651public PoC
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del wi…
- MEDIUM 5.4CVE-2026-119650public PoC
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in PrivacyController that allows authenticated users to access other users' privacy settings by supplying their uid. Attackers can send GET or POST requests to /privacy with a…
- MEDIUM 5.4CVE-2026-119644public PoC
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star e…
- MEDIUM 5.4CVE-2026-42691
Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0.
- MEDIUM 5.4CVE-2026-117606public PoC
NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use…
- MEDIUM 5.4CVE-2026-117563public PoC
MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share settings because updates lack an ownership check. Attackers can compute predictable s…
- MEDIUM 5.4CVE-2026-115994
BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated sec…
- MEDIUM 5.4CVE-2026-115326public PoC
QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers to submit refunds for other customers' service lines. Attackers can submit foreign i…
- MEDIUM 5.4CVE-2026-114698
Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.0-beta.1.
- MEDIUM 5.4CVE-2026-76287
In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or edit_data_management_pipeline_job capability could read or delete Data Management SPL2 preview jobs and results outside their ownership…
- MEDIUM 5.4CVE-2026-114079public PoC
Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other environments' deployments because DeploymentService.getDeployment scopes lookups by projectId only. Attackers with…
- MEDIUM 5.4CVE-2026-113610public PoC
Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the …
- MEDIUM 5.4CVE-2026-113600public PoC
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsController#update and #destroy use an unscoped Comment.find without authorization ch…
- MEDIUM 5.4CVE-2026-113599public PoC
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/armessages/ to inject at…
- MEDIUM 5.4CVE-2026-113597public PoC
Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameBy…
- MEDIUM 5.4CVE-2026-113353public PoC
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse thei…
- MEDIUM 5.4CVE-2026-111721public PoC
Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumera…
- MEDIUM 5.4CVE-2026-111716public PoC
Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress,…
- MEDIUM 5.4CVE-2026-111709public PoC
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply another…
- MEDIUM 5.4CVE-2026-111656public PoC
ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, …
- MEDIUM 5.4CVE-2026-111645public PoC
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to pu…
- MEDIUM 5.4CVE-2026-111640public PoC
DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the membership check for dialogs with group_type 'okr'. Authenticated users can supply the dialog_id of OKR comment dialogs to msg__list, msg__on…
- MEDIUM 5.4CVE-2026-111632public PoC
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a foreign company_id. Attackers can submit create or update requests to plugin REST API…
- MEDIUM 5.4CVE-2026-111630public PoC
abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat conversations by supplying their ConversationId. Attackers hol…
- MEDIUM 5.4CVE-2026-111611public PoC
roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or conti…
- MEDIUM 5.4CVE-2026-111610public PoC
B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to l…
- MEDIUM 5.4CVE-2026-59967public PoC
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requesting user when an aut…
- MEDIUM 5.4CVE-2026-110901
Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SmartCrawl: from n/a through 3.16.4.
- MEDIUM 5.4CVE-2026-111358public PoC
SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other workspaces' tags by supplying unvalidated tag IDs. Attackers can submit sequential tag IDs via th…
- MEDIUM 5.4CVE-2026-111348public PoC
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts c…
- MEDIUM 5.4CVE-2026-111346public PoC
ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' comments by supplying an arbitrary actionID. Attackers can iterate sequential action ids to modify …
- MEDIUM 5.4CVE-2026-103083
Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Exploiting Incorrectly Configured Access Con…
- MEDIUM 5.4CVE-2026-103988public PoC
FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise /api/folder/renameFolder.php authorizes an authenticated, non-folder-scoped, non-administrator with a valid CSRF token against the…
- MEDIUM 5.4CVE-2026-110608public PoC
BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act on other members' orders by supplying their orderId. Attackers can…
- MEDIUM 5.4CVE-2026-110226public PoC
QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types under unassigned hotels by supplying an arbitrary id_hotel. Attackers can enumerate all hotels via the unfiltered room …
- MEDIUM 5.4CVE-2026-110126public PoC
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment address ids and send POS…
- MEDIUM 5.4CVE-2026-110120public PoC
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder,…
- MEDIUM 5.4CVE-2026-110098public PoC
Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit…
- MEDIUM 5.4CVE-2026-89204
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet confi…
- MEDIUM 5.4CVE-2026-109176public PoC
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other administrators' files via POST /networkDisk/deleteFile and batchDeleteFile. Attackers can supply another administrator's fi…
- MEDIUM 5.4CVE-2026-108854public PoC
Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/ap…
- MEDIUM 5.4CVE-2026-108689public PoC
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's convers…
- MEDIUM 5.4CVE-2026-107854public PoC
Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POST /api/client/billing/free/process endpoint accepts a client-controlled server_id and loads the server without restricting the lookup to servers owned by the au…
- MEDIUM 5.4CVE-2026-107445
A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be abl…
- MEDIUM 5.4CVE-2026-17538
The LatePoint - Appointment Booking & Reservation plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.6.9. This is due to the process_step_customer() function using is_user_logged_in() as the sole gate bef…
- MEDIUM 5.4CVE-2026-105836public PoC
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms that allows hotel-restricted back-office employees to modify rooms of other hotels. Attackers can submit foreign room IDs in the id_room…
- MEDIUM 5.4CVE-2026-105698public PoC
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} handler…
- MEDIUM 5.4CVE-2026-105692public PoC
Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link ID and verifies only that the caller can edit the parent file. It does not verify that the caller created the share link…
- MEDIUM 5.4CVE-2026-104967public PoC
Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/issue/ accept body- or URL-supplied issue IDs and operate on them without checking that the IDs belong to the caller's w…
- MEDIUM 5.4CVE-2026-104965public PoC
Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own iss…
- MEDIUM 5.4CVE-2026-103079
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
- MEDIUM 5.4CVE-2026-39444
Authorization Bypass Through User-Controlled Key vulnerability in PublishPress PublishPress Series organize-series allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Series: from n/a through 3.1.3.
- MEDIUM 5.4CVE-2026-103496
In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications
youtrack
- MEDIUM 5.4CVE-2026-94173
Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.
- MEDIUM 5.4CVE-2026-62081
Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.
- MEDIUM 5.4CVE-2026-102261public PoC
A flaw has been found in owen2345 Camaleon CMS up to 2.9.2. Impacted is the function crop of the file app/controllers/camaleon_cms/admin/media_controller.rb of the component Media Crop Handler. This manipulation of the argument saved_avatar causes authorizatio…
- MEDIUM 5.4CVE-2026-93366public PoC
Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate and delete media files belonging to pages owned by other users, including administrators, by supplying arbitrary uuid par…
- MEDIUM 5.4CVE-2026-79758public PoC
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for ho…
- MEDIUM 5.4CVE-2026-84150
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route matches the authenticated caller before reading and modifying that user's saved favorites, allowing any…
- MEDIUM 5.4CVE-2026-77517public PoC
MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id in the request path, then query the target Document by document_id or Paragraph by paragraph_id withou…
- MEDIUM 5.4CVE-2026-77516public PoC
MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserResourcePermission can still bind its identifier through tool_ids, skill_tool_ids, or mcp_tool_ids and…
- MEDIUM 5.4CVE-2026-73999
Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.
- MEDIUM 5.4CVE-2026-89031
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_post AJAX handler in includes/Ajax/Post.php issues an UPDATE against the b2s_posts table using only the…
- MEDIUM 5.3CVE-2026-60042
An unauthenticated remote attacker can perform an authentication bypass on the com_check function, potentially triggering traffic on other systems and email alerts. This can result in some loss of availability due to higher system loads.
- MEDIUM 5.3CVE-2026-125386public PoC
langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that allows authenticated users to access other users' message references due to missing owner checks. Attackers can supply another use…
- MEDIUM 5.3CVE-2026-125369public PoC
Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential…
- MEDIUM 5.3CVE-2026-124551public PoC
ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its secti…
- MEDIUM 5.3CVE-2026-124451public PoC
OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because checkUserHasAccessToPatient() in BearerTokenAuthorizationStrategy.php unconditionally returns true. Authenticated users or malicious SMART apps can …
- MEDIUM 5.3CVE-2026-103375
The Antom Payments WordPress plugin through 2.0.11 does not perform any ownership or authorisation check before returning an order's confirmation link, which contains its secret key, to unauthenticated visitors, allowing attackers to view any customer's order …
- MEDIUM 5.3CVE-2026-123861
Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchical-select allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder – H…
- MEDIUM 5.3CVE-2026-122326public PoC
Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json route that allows unauthenticated attackers to list private albums by supplying another user's album id. Attackers with a session token from any…
- MEDIUM 5.3CVE-2026-119751
Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve Content Egg product data from unpublished posts by calling the REST route POST /wp-json/content-egg/v1/render-blocks…
- MEDIUM 5.3CVE-2026-121938public PoC
langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, whic…
- MEDIUM 5.3CVE-2026-107868
Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.
- MEDIUM 5.3CVE-2026-117562public PoC
rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because UnionStory.get_by_feed_offset ignores the only_publ…
- MEDIUM 5.3CVE-2026-116810public PoC
OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-bas…
- MEDIUM 5.3CVE-2026-116746public PoC
QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows unauthenticated attackers to submit reviews for arbitrary orders. Attackers can reuse the publicly exposed review_ajax_t…
- MEDIUM 5.3CVE-2026-97255
Authorization Bypass Through User-Controlled Key vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through 1.7.1069…
- MEDIUM 5.3CVE-2026-100142
The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout belongs to the requester, allowing unauthenticated attackers to attach any customer's stored address to an order they p…
- MEDIUM 5.3CVE-2026-114392public PoC
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket's subject, issue, comme…
- MEDIUM 5.3CVE-2026-111596
The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased…
- MEDIUM 5.3CVE-2026-107789
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated users to obtain the shipping labels of arbitrary orders, which contain customer names, addresses and phone nu…
- MEDIUM 5.3CVE-2026-114091public PoC
Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's runtime environment. An attacker holding any tenant's API key who knows a victim's run friendlyId can replay that ru…
- MEDIUM 5.3CVE-2026-94229
The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who…
- MEDIUM 5.3CVE-2026-111902public PoC
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that treats a missing FAQ translation as visible to unauthenticated users. Attackers can send a mismatched Accept-Language header to the comments …
- MEDIUM 5.3CVE-2026-111707public PoC
99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT…
- MEDIUM 5.3CVE-2026-111620public PoC
O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the …
- MEDIUM 5.3CVE-2026-111324public PoC
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid …
- MEDIUM 5.3CVE-2026-110774public PoC
Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored filename, following a ba…
- MEDIUM 5.3CVE-2026-110764public PoC
AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can enumerate predictable t…
- MEDIUM 5.3CVE-2026-96900
The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record before deleting or overwriting it, allowing unauthenticated attackers who know a customer's emai…
- MEDIUM 5.3CVE-2026-94261
The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from …
- MEDIUM 5.3CVE-2026-106166
The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite, permanently erase, reassign or append to any previousl…
- MEDIUM 5.3CVE-2026-107652
The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1. This is due to the plugin storing arbitrary (non-form-tag) submission fields in its db7_forms row and the proce…
- MEDIUM 5.3CVE-2026-108862public PoC
APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one applica…
- MEDIUM 5.3CVE-2026-108724public PoC
Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the AcceptedExtension filter is not applied to the item operation. Attackers can enumerate sequen…
- MEDIUM 5.3CVE-2026-108596public PoC
OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id can query the trace …
- MEDIUM 5.3CVE-2026-105893
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1.
- MEDIUM 5.3CVE-2026-105198
The Appointment Booking Plugin WordPress plugin before 5.7.3 does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summary, letting an unauthenticated visitor retrieve any customer's n…
- MEDIUM 5.3CVE-2026-84169
The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without ma…
- MEDIUM 5.3CVE-2026-104118
The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used during checkout, allowing unauthenticated attackers to modify the shipping information stored on arbitrary orders.
- MEDIUM 5.3CVE-2026-94405
Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue affects Download Manager: from n/a through 3.3.71.
- MEDIUM 5.3CVE-2026-104403
Authorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects LearnPress: from n/a through 4.4.9.
- MEDIUM 5.3CVE-2026-94432
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.1 via the OsPaypalConnectController::create_order_for_transaction() ac…
- MEDIUM 5.3CVE-2026-62061
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGrid: from n/a through 6.…
- MEDIUM 5.3CVE-2026-96173
The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a public payment-callback request, allowing unauthenticated attackers to obtain the order key of an arbitrary order and v…
- MEDIUM 5.3CVE-2026-103476public PoC
yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated attackers to download files from draft articles. Attackers can enumerate sequential attachment identifiers to retrieve fil…
- MEDIUM 5.3CVE-2026-97282
Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.
- MEDIUM 5.3CVE-2026-97078
Unauthenticated Insecure Direct Object References (IDOR) in Client Invoicing by Sprout Invoices <= 20.8.17 versions.
- MEDIUM 5.3CVE-2026-97066
Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.
- MEDIUM 5.3CVE-2026-94673
Unauthenticated Insecure Direct Object References (IDOR) in Simply Schedule Appointments <= 1.6.12.31 versions.
- MEDIUM 5.3CVE-2026-92436
The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker w…
- MEDIUM 5.3CVE-2026-86837
The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details, allowing unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information su…
- MEDIUM 5.3CVE-2026-97647public PoC
A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown function of the file user/editLog.php. Such manipulation of the argument sid/addtime/type/reason/detail/l…
- MEDIUM 5.3CVE-2026-95592
Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.
- MEDIUM 5.3CVE-2026-93623
Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.
- MEDIUM 5.3CVE-2026-66575
Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.
- MEDIUM 5.3CVE-2026-88910
The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently delete its uploaded media files and their database records by iterating identifiers.
- MEDIUM 5.3CVE-2026-82125
The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before returning its content, allowing unauthenticated users to read the content of comments still awaiting mod…
- MEDIUM 5.3CVE-2026-16981
The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership check) on one of its shipping-label download endpoints, so an unauthenticated attacker can enumerate sequ…
- MEDIUM 5CVE-2026-17428
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization. Values supplied in the request URL are used in authorization decisions without s…
- MEDIUM 5CVE-2026-17371
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- MEDIUM 5CVE-2026-17366
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization.
- MEDIUM 5CVE-2026-17064
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to an insecure direct object reference.
- MEDIUM 5CVE-2026-119657public PoC
FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another libr…
- MEDIUM 5CVE-2026-116187public PoC
Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows authenticated tenants to manipulate other tenants' multipart uploads by referencing their upload IDs. Attackers who learn a victim's bucket, …
rclone
- MEDIUM 5CVE-2026-116185public PoC
OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read other realms' gateway tunnel information via getGatewayActiveTunnelInfos. Attackers can request the gateway tunnel endpoint with their own real…
- MEDIUM 5CVE-2026-94494public PoC
jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including …
- MEDIUM 4.9CVE-2026-121759
The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the trash, which could allow users with a role as low as Contributor to trash arbitrary posts and pages, or delete them permanently where the trash …
- MEDIUM 4.9CVE-2026-115259
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authentica…
- MEDIUM 4.9CVE-2026-111972
The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targeted media attachment, allowing authenticated users with the author role and above to delete arbitrary media attachments, i…
- MEDIUM 4.9CVE-2026-110514
The WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order, which could allow users with the contributor role and above to convert any other user's posts and pages into port…
- MEDIUM 4.9CVE-2026-111616public PoC
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site'…
- MEDIUM 4.9CVE-2026-78412
Velociraptor's WatchEvent gRPC API can specify the OrgId of the org from which events should be streamed. The server checks the API permissions against the caller's Org instead of the requested Org. This allows a user with API access in one org to read events …
- MEDIUM 4.9CVE-2026-100272
In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues
youtrack
- MEDIUM 4.9CVE-2026-55625public PoC
GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/internal/config_repos/*/material_test accept an arbitrary existing pipeline and pipeline-group context…
- MEDIUM 4.6CVE-2026-111939public PoC
Frappe Helpdesk before 1.26.0 contains an authorization bypass vulnerability that allows authenticated portal users to create tickets impersonating other customers by supplying a raised_by value. Attackers can call the hd_ticket.api.new endpoint with a victim'…
- MEDIUM 4.6CVE-2026-102107public PoC
Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, because the server did not verify that the requester was authorized to act as the sp…
- MEDIUM 4.5CVE-2026-107856public PoC
CiviForm simplifies applications for government benefits programs by reusing applicant data across multiple benefit applications. Prior to 3.33.0, GET /admin/tiDash/editClientForm/:accountId verifies that the requester is a Trusted Intermediary but showEditCli…
- MEDIUM 4.3CVE-2026-125374public PoC
Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and detach actions that skip the data-scope check. Authenticated users restricted to individual or group data scope can add or remove tags on leads …
- MEDIUM 4.3CVE-2026-125372public PoC
REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-de…
- MEDIUM 4.3CVE-2026-113702public PoC
A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function local_iomad_pluginfile in the library public/local/iomad/lib.php of the component PDF Certificate Handler. The manipulation results in …
- MEDIUM 4.3CVE-2026-123518public PoC
Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write…
- MEDIUM 4.3CVE-2026-118534
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the order targeted by its checkout payment-retry REST action belongs to the requesting user, allowing any authenticated user, such as a …
- MEDIUM 4.3CVE-2026-118533
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not verify that the user requesting an order's payment receipt owns that order, allowing any authenticated user, such as a subscriber, to disclose other…
- MEDIUM 4.3CVE-2026-118528
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11 does not validate that the requesting user owns the referenced listing before returning its metadata via an AJAX action, allowing authenticated attackers wit…
- MEDIUM 4.3CVE-2026-119800public PoC
Ryot is a self-hosted personal tracking application. Prior to 10.5.6, the collectionContents GraphQL query implemented by collection_contents() in crates/services/collection/src/content_operations.rs accepts a caller-controlled CollectionContentsInput.collecti…
- MEDIUM 4.3CVE-2026-124025public PoC
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticket_print and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticket…
- MEDIUM 4.3CVE-2026-62851public PoC
FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, the search-by-number shortcut in ConversationsController::search() resolves a user-controlled ticket number without applying the mailbox filter or view policy used by the normal search …
- MEDIUM 4.3CVE-2026-123677public PoC
A vulnerability was found in xxyopen/201206030 novel up to 3.5.0. Affected is the function getBookChapter of the file src/main/java/io/github/xxyopen/novel/service/impl/BookServiceImpl.java of the component Book Chapter Read Handler. Performing a manipulation …
- MEDIUM 4.3CVE-2026-123782public PoC
ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own form_id to satisfy the ownership check …
- MEDIUM 4.3CVE-2026-123291
In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook
- MEDIUM 4.3CVE-2026-104867public PoC
Immich is a high-performance self-hosted photo and video management solution. From 3.0.0 until 3.2.0, the GET /api/admin/users/{id}/calendar-heatmap route in server/src/controllers/user-admin.controller.ts uses the ordinary Permission.UserRead permission witho…
- MEDIUM 4.3CVE-2026-122317public PoC
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer user ids to harvest ev…
- MEDIUM 4.3CVE-2026-90967
The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, acc…
- MEDIUM 4.3CVE-2026-121585public PoC
A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc2. This impacts the function RunSQL of the file internal/engine/infinity/sql.go of the component Text To SQL Retrieval. The manipulation of the argument tableName/kbIDs results in a…
- MEDIUM 4.3CVE-2026-115295
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read access to connectors in one Kibana space can retriev…
- MEDIUM 4.3CVE-2026-115292
Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with Machine Learning read access in one Kiba…
- MEDIUM 4.3CVE-2026-121558public PoC
AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py that allows authenticated users to read other projects' knowledge by supplying project_id. Attackers with read:knowledge scoped to one pr…
- MEDIUM 4.3CVE-2026-121442public PoC
Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve expe…
- MEDIUM 4.3CVE-2026-120427public PoC
MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retrieve the private templat…
- MEDIUM 4.3CVE-2026-120199public PoC
LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another user_id to the submissions grade endpoint or query submission…
- MEDIUM 4.3CVE-2026-119329public PoC
Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts …
- MEDIUM 4.3CVE-2026-119664public PoC
Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can …
- MEDIUM 4.3CVE-2026-119663public PoC
Tamery (formerly Conar) 0.32.0 before 0.99.0 contains a broken authorization vulnerability in the cloud sync API connectionsResources.create handler that allows authenticated users to attach resources to other users' connections. Attackers owning one connectio…
- MEDIUM 4.3CVE-2026-119658public PoC
PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any on…
- MEDIUM 4.3CVE-2026-119652public PoC
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/…
- MEDIUM 4.3CVE-2026-119647public PoC
RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can req…
- MEDIUM 4.3CVE-2026-119646public PoC
Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data because clickstream and transaction reports are not scoped to the authorized siteId. Users with view_reports on one site c…
- MEDIUM 4.3CVE-2026-119598public PoC
Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment external_subscription_id…
- MEDIUM 4.3CVE-2026-119596public PoC
UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} en…
- MEDIUM 4.3CVE-2026-119555public PoC
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service. The service lacks group-membership and enrolment checks, so non-…
- MEDIUM 4.3CVE-2026-119547
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can e…
- MEDIUM 4.3CVE-2026-118947
A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's authorization and identity services. The issue occurs when remote resource management is enabled, allowing an authentica…
- MEDIUM 4.3CVE-2026-108763
The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler to the current user's own account, taking the target user ID from a client-supplied request field with no ownership or capability check, allo…
- MEDIUM 4.3CVE-2026-117605public PoC
nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors …
- MEDIUM 4.3CVE-2026-16307
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7.
- MEDIUM 4.3CVE-2026-116340public PoC
A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of the argument space-id …
- MEDIUM 4.3CVE-2026-116018public PoC
ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification …
- MEDIUM 4.3CVE-2026-116017public PoC
Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-r…
- MEDIUM 4.3CVE-2026-116015public PoC
yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerat…
- MEDIUM 4.3CVE-2026-116010
RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST…
- MEDIUM 4.3CVE-2026-115998
IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transf…
- MEDIUM 4.3CVE-2026-115803
A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorizatio…
- MEDIUM 4.3CVE-2026-113489
The GeoDirectory WordPress plugin before 2.8.194 does not verify that a referenced attachment belongs to the listing being saved, allowing users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images…
- MEDIUM 4.3CVE-2026-93634public PoC
A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another user's mailbox through FileSharedWithMeRequest. The request bypasses delegated-account authorization …
zimbra collaboration suite
- MEDIUM 4.3CVE-2026-115322public PoC
Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID. Attackers with permission on one project can supply…
- MEDIUM 4.3CVE-2026-115321public PoC
Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID. Attackers with any project role, including…
- MEDIUM 4.3CVE-2026-13319
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, could have allowed an authenticated to read milestone metadata, including titles, descriptions, and full project pa…
gitlab
- MEDIUM 4.3CVE-2026-112868
Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.
- MEDIUM 4.3CVE-2026-114395public PoC
Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cId values to POST /api/v…
- MEDIUM 4.3CVE-2026-114394public PoC
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, postInternalNote, and tic…
- MEDIUM 4.3CVE-2026-114393public PoC
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary ticket ObjectIds to change…
- MEDIUM 4.3CVE-2026-114389public PoC
Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enumerate exeId and questio…
- MEDIUM 4.3CVE-2026-113643public PoC
A vulnerability was found in EspoCRM up to 9.3.10/10.0.10. This affects the function ImageSourceProvider::get of the file application/Espo/Tools/Pdf/Dompdf/ImageSourceProvider.php of the component PDF Rendering Pipeline. Performing a manipulation of the argume…
- MEDIUM 4.3CVE-2026-113655public PoC
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move operation to change sibli…
- MEDIUM 4.3CVE-2026-113598public PoC
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX an…
- MEDIUM 4.3CVE-2026-113359public PoC
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinc…
- MEDIUM 4.3CVE-2026-113349public PoC
OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary e…
- MEDIUM 4.3CVE-2026-112294public PoC
FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests t…
- MEDIUM 4.3CVE-2026-110902
Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1.
- MEDIUM 4.3CVE-2026-92715
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it pos…
- MEDIUM 4.3CVE-2026-111717public PoC
Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read pe…
- MEDIUM 4.3CVE-2026-111715public PoC
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neigh…
- MEDIUM 4.3CVE-2026-111705public PoC
Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the aut…
- MEDIUM 4.3CVE-2026-111689public PoC
Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope. Attackers can request GET /xboot/user/getByDepartmentId/{departmentId} with arbitrary …
- MEDIUM 4.3CVE-2026-111676public PoC
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read tick…
- MEDIUM 4.3CVE-2026-111674public PoC
Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album li…
- MEDIUM 4.3CVE-2026-111672public PoC
Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, lo…
- MEDIUM 4.3CVE-2026-111667public PoC
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private…
- MEDIUM 4.3CVE-2026-111657public PoC
BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of RmaController that allows authenticated customers to modify other customers' returns. Attackers can submit sequential RMA ids to the account/r…
- MEDIUM 4.3CVE-2026-111647public PoC
PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated buyers to read other buyers' invoice records because ReceiptServiceImpl.getDetail performs no ownership check. Attackers can supply another buy…
- MEDIUM 4.3CVE-2026-111629public PoC
IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API handlers do not scope queries to the caller's tenant. Attackers can self-register…
- MEDIUM 4.3CVE-2026-111621public PoC
TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to o…
- MEDIUM 4.3CVE-2026-111603public PoC
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate sequential course and att…
- MEDIUM 4.3CVE-2026-89280public PoC
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.2.1 via the 'password' parameter due to missin…
- MEDIUM 4.3CVE-2026-111345public PoC
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id. Attackers can request GET /api/v1/messages/conversation/:id, which lacks participant …
- MEDIUM 4.3CVE-2026-111344public PoC
APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/{nodeId}/description, which skips spa…
- MEDIUM 4.3CVE-2026-46708public PoC
EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The…
- MEDIUM 4.3CVE-2026-108092
The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4. This is due to the b2s_ship_item and b2s_ship_item_reload_url AJAX handlers lacking per-obj…
- MEDIUM 4.3CVE-2026-110771public PoC
Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/products/{id}/reviews to publ…
- MEDIUM 4.3CVE-2026-110763public PoC
lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can iterate sequential employe…
- MEDIUM 4.3CVE-2026-88927
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, allowing users with a subscriber-level account or above to place media into another user's pri…
- MEDIUM 4.3CVE-2026-110467
Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view the peer review scores of any student.
- MEDIUM 4.3CVE-2026-110465
Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student.
- MEDIUM 4.3CVE-2026-107319
The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated user, such as a Subscriber, to read arbitrary entries from its activity log, includi…
- MEDIUM 4.3CVE-2026-110213public PoC
Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation results by supplying arbitrary task ids. Attackers can enumerate auto-increment task ids on the im…
- MEDIUM 4.3CVE-2026-110127public PoC
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST…
- MEDIUM 4.3CVE-2026-110122public PoC
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.fr…
- MEDIUM 4.3CVE-2026-110113public PoC
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can submit another member'…
- MEDIUM 4.3CVE-2026-109963public PoC
Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by mailbodyid without an adminid ownership check. Authenticated reseller admins can pair their …
- MEDIUM 4.3CVE-2026-109957public PoC
EspoCRM before 10.0.7 contains an insecure direct object reference vulnerability that allows authenticated users with Import scope access to read other users' attachments by supplying a foreign attachmentId to the Import endpoint. Attackers can create an Impor…
- MEDIUM 4.3CVE-2026-109675public PoC
Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMA…
- MEDIUM 4.3CVE-2026-108924public PoC
A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass.…
- MEDIUM 4.3CVE-2026-102663public PoC
OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results a…
- MEDIUM 4.3CVE-2026-109303public PoC
Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-user groups) on count queries using the $relatedTo operator, exposing the size of protected Relation fields. An authentica…
- MEDIUM 4.3CVE-2026-109296public PoC
Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollam…
- MEDIUM 4.3CVE-2026-109287public PoC
Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained fo…
- MEDIUM 4.3CVE-2026-109180public PoC
jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by supplying depotId or depotIds request parameters. When depot_flag warehouse restriction is enabled, attackers can name …
- MEDIUM 4.3CVE-2026-109177public PoC
MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files by supplying their file paths. Attackers can send crafted requests to POST /networkDisk/move…
- MEDIUM 4.3CVE-2026-109175public PoC
MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other administrators' network-disk files via POST /networkDisk/getFileList. Attackers can query the endpoint, which filters only by…
- MEDIUM 4.3CVE-2026-109167public PoC
TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite other users' form themes. Attackers whose form has no theme can submit another form's sequential …
- MEDIUM 4.3CVE-2026-109165public PoC
TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/item/batch/create. Attackers can submit an array whose first element references their own form …
- MEDIUM 4.3CVE-2026-84167
The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone nu…
- MEDIUM 4.3CVE-2026-108797
A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affects unknown code of the file /personnel/api/employees/ of the component Employee REST API. The manipulation leads to authorization bypass. The attack may be init…
- MEDIUM 4.3CVE-2026-108796
A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of the file /iclock/finger_data/ of the component Biometric Data Endpoint. Executing a manipulation of the argument emp_code can lead to authorization bypass. The a…
- MEDIUM 4.3CVE-2026-108879public PoC
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat variables via the username parameter. Attackers can send POST requests to /airag/api/getCh…
- MEDIUM 4.3CVE-2026-108715public PoC
LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokeping_i…
- MEDIUM 4.3CVE-2026-108574public PoC
A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_view_session_spend_logs of the file litellm/proxy/spend_tracking/spend_management_endpoints.py of the component Spend Tracking. Executing a manipulation of the arg…
- MEDIUM 4.3CVE-2026-108704public PoC
CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id. Attackers can send requests to the follow/record/add endpoints to a…
- MEDIUM 4.3CVE-2026-108696public PoC
CoreShop through 1.5.5 contains an authorization bypass vulnerability in the OrderController that allows authenticated customers to act on other customers' orders by supplying user-controlled ids. Attackers can omit the data field in OrderConfirm or supply ano…
- MEDIUM 4.3CVE-2026-108672public PoC
JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply anothe…
- MEDIUM 4.3CVE-2026-108642public PoC
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list an…
- MEDIUM 4.3CVE-2026-108641public PoC
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids fr…
- MEDIUM 4.3CVE-2026-108609public PoC
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id ca…
- MEDIUM 4.3CVE-2026-108608public PoC
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record id…
- MEDIUM 4.3CVE-2026-108607public PoC
JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can o…
- MEDIUM 4.3CVE-2026-91050
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference / Missing Authorization in versions up to, and including, 5.7.2. This is due to the publicly reachable steps…
- MEDIUM 4.3CVE-2026-107850public PoC
Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefor…
- MEDIUM 4.3CVE-2026-78026
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to El…
policy manager for secure connect gateway
- MEDIUM 4.3CVE-2026-107793public PoC
Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated users to delete other users' subscriptions by ID. Attackers can submit a delete action to /account/protected/sub/subSaveA…
- MEDIUM 4.3CVE-2026-107702public PoC
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_ho…
- MEDIUM 4.3CVE-2026-107637public PoC
pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper authorization vulnerability in the note module delete() action that allows authenticated members to delete other members' note comments and categories. Attackers can submit another member's …
- MEDIUM 4.3CVE-2026-107444
A flaw was found in Katello where the Docker Tags repositories API does not properly enforce organization scoping when listing repositories for a Docker meta tag. An authenticated user with permission to view products in one organization may be able to retriev…
- MEDIUM 4.3CVE-2026-76278
In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the edit_spl2_module_permissions capability could use the affected Representational State Transfer (REST) API to access permission grants for SPL2 modules that the u…
- MEDIUM 4.3CVE-2026-104651
The Yaad Sarig Payment Gateway For WC WordPress plugin before 2.2.13 does not verify authorization or that the requesting user owns the target order in several of its order payment-processing actions, allowing any authenticated user, including subscribers, to …
- MEDIUM 4.3CVE-2026-104050
The Academy LMS WordPress plugin before 4.0.0 does not verify that a quiz question belongs to the course the requesting user is authorized to access before returning that question's answer options, allowing any authenticated user with access to a single cours…
- MEDIUM 4.3CVE-2026-104049
The Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of its REST API routes, allowing users with a self-registerable student account to read the full content of arbit…
- MEDIUM 4.3CVE-2026-105268public PoC
The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to comments on the issue. Because the author of an issue may edit and delete the issue's attachments, a user…
- MEDIUM 4.3CVE-2026-87975public PoC
An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.forms.models.BaseModelFormSet.save_existing_objects()` used the presence of a primary key on a submitted form's instance as evidence that the instance belonged…
- MEDIUM 4.3CVE-2026-105572public PoC
A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to …
- MEDIUM 4.3CVE-2026-104894public PoC
Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating that they belong to the caller's workspace. An authenticated user can link issues from any workspace to modules in thei…
- MEDIUM 4.3CVE-2026-103078
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0.
- MEDIUM 4.3CVE-2026-105097public PoC
A vulnerability was identified in Omega Solution CoinEx Crypto 2025. This impacts an unknown function of the file /customer-currency/ of the component Customer Information API. The manipulation of the argument ID leads to authorization bypass. Remote exploitat…
- MEDIUM 4.3CVE-2026-11399
The Helpdesk Support Ticket System for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.6 via the 'id' parameter due to missing validation on a user controlled key. This makes it possi…
- MEDIUM 4.3CVE-2026-105029public PoC
UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticket…
- MEDIUM 4.3CVE-2026-94180
Authorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sensitive Data. This issue affects Advanced Ads: from n/a through 2.0.26.
- MEDIUM 4.3CVE-2026-102382
Authorization Bypass Through User-Controlled Key vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0.
- MEDIUM 4.3CVE-2026-97079
Subscriber Insecure Direct Object References (IDOR) in Webba Booking <= 6.5.0 versions.
- MEDIUM 4.3CVE-2026-97074
Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.
- MEDIUM 4.3CVE-2026-94672
Contributor Insecure Direct Object References (IDOR) in Safe SVG <= 2.5.0 versions.
- MEDIUM 4.3CVE-2026-79348public PoC
KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the …
- MEDIUM 4.3CVE-2026-101033public PoC
KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking ho…
- MEDIUM 4.3CVE-2026-100626public PoC
capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-controlled icon storage paths. Authenticated users can supply arbitrary paths in the private images bucket and obtain servic…
- MEDIUM 4.3CVE-2026-52850public PoC
Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space can call the transclusion / sync-block lookup API with a known sourcePageId and transclusionId pair …
- MEDIUM 4.3CVE-2026-48073public PoC
Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable page can embed a forged attachmentId that belongs to a restricted page in the same space. Exporting t…
- MEDIUM 4.3CVE-2026-79759public PoC
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id/deploy-to-host endpoint resolves credential and target-host records from attacker-controlled credent…
- MEDIUM 4.3CVE-2026-78310
Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022.
- MEDIUM 4.3CVE-2026-82849
The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any authenticated user, such as a self-registered subscriber, to read another user's learning activity. …
- MEDIUM 4.3CVE-2026-93513
Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.
- MEDIUM 4.3CVE-2026-91025
The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-l…
- MEDIUM 4.3CVE-2026-81339
The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowing any authenticated user with a minimal (subscriber) role to read other students' quiz grades, pass/…
- MEDIUM 4.3CVE-2026-77766
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order an…
- MEDIUM 4.3CVE-2026-77425public PoC
Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/strategies/set-sort-order passes attacker-controlled strategy IDs to unprotectedUpdateStrategiesSortOrder…
- MEDIUM 4.3CVE-2026-18439
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, a…
- MEDIUM 4.3CVE-2026-12995
The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the edit_meta_value due to missing validation on a user controlled key. This makes it possible for authenticated at…
- MEDIUM 4.3CVE-2026-94536public PoC
lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employee's roles and permissions. Attackers can supply arbitrary employeeId values to enumerate other employ…
- MEDIUM 4.3CVE-2026-61748public PoC
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/ require authentication but do not call users.permissions.check_user_permission for the caller's per-…
- MEDIUM 4.3CVE-2026-61747public PoC
InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow and DataImportColumnMap querysets to the owner of the associated DataImportSession. Any authenticate…
- MEDIUM 4.3CVE-2026-88978public PoC
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to L…
- MEDIUM 4.3CVE-2026-52743public PoC
GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belongs to the pipeline and stage named in the request. An authenticated user can guess job IDs and retriev…
- MEDIUM 4.3CVE-2025-71420public PoC
UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restricted to other support groups. Attackers with ROLE_AGENT can enumerate saved reply identifiers…
- MEDIUM 4.3CVE-2026-94152public PoC
A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote exploi…
- MEDIUM 4.3CVE-2026-93955public PoC
A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Per…
- MEDIUM 4.3CVE-2026-89029
Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX handler in includes/Ajax/Get.php resolves arbitrary user IDs supplied in the owner parameter to display…
- MEDIUM 4.3CVE-2026-70488public PoC
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request b…
- MEDIUM 4.2CVE-2026-121631public PoC
Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the …
- MEDIUM 4.2CVE-2026-119661public PoC
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other us…
- MEDIUM 4.2CVE-2026-119048public PoC
JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a…
- MEDIUM 4.2CVE-2026-109848public PoC
GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages withou…
- MEDIUM 4.2CVE-2026-105272public PoC
GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages withou…
- MEDIUM 4.2CVE-2026-115725public PoC
Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's sour…
- MEDIUM 4.2CVE-2026-111608public PoC
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER…
- MEDIUM 4.2CVE-2026-111351public PoC
metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCa…
- MEDIUM 4.2CVE-2026-110107public PoC
RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes…
- MEDIUM 4.2CVE-2026-110106public PoC
RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId} requests with a …
- MEDIUM 4.2CVE-2026-108864public PoC
iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume. Attackers can predict S…
- MEDIUM 4.2CVE-2026-108856public PoC
UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key. Attackers supplying a victim's MCP server UUID with appType mcpserver c…
- MEDIUM 4.2CVE-2026-108747public PoC
Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens rout…
- MEDIUM 4.2CVE-2026-105755public PoC
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, flash late-interaction scoring at the /score and /rerank endpoints derives each worker's query_key value from the caller-controlled X-Request-Id header. A concurrent request th…
vllm
- MEDIUM 4.2CVE-2026-94382public PoC
Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authenticated user to create or delete alerts on systems they cannot access. Attackers can supply arbitrary …
- MEDIUM 4.2CVE-2026-81653
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag an…
- LOW 3.8CVE-2026-108067
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing authenticated users with Contributor-level access and above to modify or delete ar…
- LOW 3.8CVE-2026-111961
The Royal MCP WordPress plugin before 1.5.10 does not perform an object-level permission check before duplicating a requested page, relying on a generic capability, which allows users with contributor-level access to read the full content of any private or dr…
- LOW 3.8CVE-2026-114741
The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.
- LOW 3.8CVE-2026-111658public PoC
SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read…
- LOW 3.8CVE-2026-111655public PoC
ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node…
- LOW 3.8CVE-2026-111609public PoC
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential…
- LOW 3.8CVE-2026-111604public PoC
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit or user:del permissions…
- LOW 3.8CVE-2026-86839
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested through its staff-role AJAX actions belong to the requesting staff member, allowing authenticated attackers with a…
- LOW 3.7CVE-2026-119213
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to unauthenticated modification of a linked customer's stored profile fields in versions up to, and including, 2.4.7 Its first-party Fluent Forms integration (Fee…
- LOW 3.7CVE-2026-118403
The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who know a guest order's identifier to view its order status, payment status and total.
- LOW 3.7CVE-2026-119571public PoC
Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers kno…
- LOW 3.7CVE-2026-113665public PoC
ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying that the requester is au…
- LOW 3.3CVE-2026-105196
The Appointment Booking Plugin WordPress plugin before 5.6.9 does not enforce per-record authorization on several of its AI Abilities API actions, allowing an authenticated user holding the LatePoint Agent role, normally restricted to their own records, to re…
- LOW 3.1CVE-2026-125379public PoC
Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated users to read restricted posts by supplying server, node and nodeid values. Attackers who know item identifiers can retrieve cached community or …
- LOW 3.1CVE-2026-122325public PoC
fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled can submit another eve…
- LOW 3.1CVE-2026-122324public PoC
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUID, such as removed form…
- LOW 3.1CVE-2026-121937public PoC
loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read other users' ticket flow history by supplying a ticket UUID. Attackers can request the ticket_flow_history endpoint, which…
- LOW 3.1CVE-2026-119548public PoC
Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers controlling their organiza…
- LOW 3.1CVE-2026-87098
Sensitive information disclosure due to improper authorization. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 42587.
- LOW 3.1CVE-2026-113596public PoC
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /t…
- LOW 3.1CVE-2026-112004public PoC
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|upda…
- LOW 3.1CVE-2026-111354public PoC
crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers. Attackers can request /api/front/order/express/{orderId} or /api/front/order/apply/refund/{o…
- LOW 3.1CVE-2026-111169public PoC
La Suite Docs through 6.0.1 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access. Attackers who know a thread UUID can route a POST comment request through their own docum…
- LOW 3.1CVE-2026-109195
A flaw was found in Quay. An authenticated attacker can access repository auto-prune configurations from other namespaces, leading to unauthorized information disclosure. This issue occurs because the application does not properly enforce namespace scoping whe…
- LOW 3.1CVE-2026-87108
An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the required record identifier. Insufficient ownership validation can expose deployment metadata, …
- LOW 3.1CVE-2026-100534public PoC
OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in webhook TaskFlow cancellation that allows attackers to cancel unrelated sessions. An attacker with a webhook route secret can supply an arbitrary child session key to cancel ACP…
- LOW 3.1CVE-2026-84298public PoC
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership…
- LOW 3.1CVE-2026-81654
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing settings, allowing users granted only its gallery-management capability by an administrator to change se…
- LOW 3.1CVE-2026-81651
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its gallery-management capability by an administrator to overwrite the stored settings of any gallery on …
- LOW 2.7CVE-2026-97193
The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to add or rem…
- LOW 2.7CVE-2026-97190
The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationship synchronization, allowing users with contributor-level access and above to …
- LOW 2.7CVE-2026-118187
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that…
- LOW 2.7CVE-2026-121732public PoC
RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute foreign studen…
- LOW 2.7CVE-2026-59385
A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of existing broker credentials by redirecting them to a broker under their control. The CF API does not permit direct read…
- LOW 2.7CVE-2026-114742
The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.
- LOW 2.7CVE-2026-105257
The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal informati…
- LOW 2.7CVE-2026-111648public PoC
BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can over…
- LOW 2.7CVE-2026-108066
The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a site administrator on WordPress Multisite to remove the 2FA configuration of users outside …
- LOW 2.7CVE-2026-104684
The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read a gallery before rendering it, allowing authors to embed and expose other users' non-public gallery metadata to unauthenticated visitors.
- LOW 2.7CVE-2026-105197
The Appointment Booking Plugin WordPress plugin before 5.6.5 does not verify that a backend staff user is authorized to act on the specific record targeted for deletion, allowing an authenticated user with a record-scoped staff role to irreversibly delete any…
- LOW 2.7CVE-2026-104645
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not properly verify authorization on several of its gallery and image management actions, checking ownership against a different object than the one being acted on, or omitting the ch…
- LOW 2.7CVE-2026-102844public PoC
A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects the function detail of the file application/modules/admin/controllers/laporan_data_pasien.php. Executing a manipulation …
- LOW 2.7CVE-2026-97721public PoC
A weakness has been identified in Sanluan PublicCMS up to 6.202506.e. This vulnerability affects the function CmsContentAdminController of the file publiccms-parent/publiccms-core/src/main/java/com/publiccms/controller/admin/sys/SysUserAdminController.java of …
- LOW 2.7CVE-2026-93661
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to t…
- LOW 2.7CVE-2026-89004
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and run log, allowing users with contributor-level access and above to read the configuration and execut…
- LOW 2.7CVE-2026-81652
The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before returning it, allowing users with the Contributor role and above to read the stored metadata of any ima…
- LOW 2.7CVE-2026-16746
The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowing any vendor-level user to read other vendors' commission and financial data.
- LOW 2.7CVE-2026-16070
The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validating a request parameter that is different from the one used in the write operation, allowing users with…
- LOW 2.2CVE-2026-105977
The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment, allowing users with the Contributor role and above to permanently delete certain media attachments belonging to other u…
- UNSCOREDCVE-2026-87857public PoC
Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request,…
- UNSCOREDCVE-2026-121880
Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.…
- UNSCOREDCVE-2026-111490
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal…
- UNSCOREDCVE-2026-107130
Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0
- UNSCOREDCVE-2026-114272
Authorization Bypass Through User-Controlled Key in the content viewing component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with role-scoped content view permission to read the data of content they are not authorized t…
- UNSCOREDCVE-2026-114271
Authorization Bypass Through User-Controlled Key in the shopping list services in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated low-privileged user, such as a self-registered ecommerce customer, to modify another party's shopping …
- UNSCOREDCVE-2026-109837
Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user with low-privileged Order Manager access to associate another party's OrderItem with a ReturnItem on a ReturnH…
- UNSCOREDCVE-2026-109129
Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all platforms allows an authenticated user with only view-level order permissions to modify or create OrderPaymentPreference records belonging to orders…
- UNSCOREDCVE-2026-119215public PoC
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuth…
- UNSCOREDCVE-2026-108046
Direct Object Reference (IDOR) vulnerability in Alosuite due to insufficient authorization checks when processing object identifiers. By modifying the identifier provided to the ‘/Companies/Edit/{id}’ endpoint, an attacker can access information associated wit…
- UNSCOREDCVE-2026-120333
The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can there…
- UNSCOREDCVE-2026-120328
The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.
- UNSCOREDCVE-2026-105605
Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “duplicate my ad” convenience feature on the new-ad form (site/models/additem.php) loaded an existing advert by its raw numeric ID with no…
- UNSCOREDCVE-2026-63401public PoC
Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUser` accepted arbitrary `queueId` and `userId` values without organization scoping. An authenticated user belonging to one…
- UNSCOREDCVE-2026-119038
Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirm_resource takes no session token from the caller. It re…
- UNSCOREDCVE-2026-66091public PoC
In openEQUELLA before 2026.1, the GET /api/userquery/userinfobackup endpoint performs no authentication or authorisation check. An unauthenticated attacker who supplies another user's uniqueId can retrieve that user's stored personal details (username, first n…
- UNSCOREDCVE-2026-55561public PoC
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The `approve()` and `reject()` methods…
- UNSCOREDCVE-2026-118668public PoC
langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary …
- UNSCOREDCVE-2026-96581public PoC
Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash allows a user of one tenant to read, overwrite and take over another tenant's records via an upserting create action. Under attribute multitenancy, Ash.Actions.Create (lib/ash/a…
- UNSCOREDCVE-2026-116186public PoC
OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a r…
- UNSCOREDCVE-2026-116184public PoC
OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a serv…
- UNSCOREDCVE-2026-115453public PoC
Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete…
- UNSCOREDCVE-2026-9589
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration prop…
- UNSCOREDCVE-2026-112240
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visi…
- UNSCOREDCVE-2026-112068
The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
- UNSCOREDCVE-2026-108126public PoC
temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the re…
- UNSCOREDCVE-2026-61838public PoC
Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-…
- UNSCOREDCVE-2026-110853public PoC
n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials…
- UNSCOREDCVE-2026-110851public PoC
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which pr…
- UNSCOREDCVE-2026-110841public PoC
n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list …
- UNSCOREDCVE-2026-102298
In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distin…
- UNSCOREDCVE-2026-55387public PoC
InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently bindin…
- UNSCOREDCVE-2026-15468
Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation. This issue affects HYPR Passwordless: before 11.3.3.
- UNSCOREDCVE-2026-89140public PoC
Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address tempora…
- UNSCOREDCVE-2026-105867public PoC
Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection …
- UNSCOREDCVE-2026-105847public PoC
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restri…
- UNSCOREDCVE-2026-91107public PoC
openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password.
- UNSCOREDCVE-2026-105699public PoC
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read.…
- UNSCOREDCVE-2026-97305
Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Chatbot for WordPress – Hyve Lite: from n/a…
- UNSCOREDCVE-2026-97070
Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through 2.2.23.
- UNSCOREDCVE-2026-104966public PoC
Plane is an open-source project management tool. Prior to 1.4.0, two endpoint families fail to verify that nested resource identifiers belong to the workspace and project named in the URL. An authenticated user can read or modify estimates from another workspa…
- UNSCOREDCVE-2026-102775
Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for. The d (download token) and o (order tok…
- UNSCOREDCVE-2026-64948
Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onwards.
- UNSCOREDCVE-2026-103446
Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass. This issue affects MediaWiki WikiLambda extension: 1.46.
- UNSCOREDCVE-2026-97259
Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.4.
- UNSCOREDCVE-2026-74865
sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arbitrary password can suc…
- UNSCOREDCVE-2026-74864
sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any client can supply it arbi…
- UNSCOREDCVE-2026-103237public PoC
MISP contains an improper input validation vulnerability in its ORM save path. When a user submits data through various endpoints (attribute add/edit, event edit, free-text import, sighting capture, shadow attribute proposal, event report creation, object refe…
- UNSCOREDCVE-2026-103235public PoC
MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation request, the application authorized the user against the event identified in the URL but then persisted the entire submit…
- UNSCOREDCVE-2026-90907
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites with…
- UNSCOREDCVE-2026-101112
Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4 - The public removeTmpAttachment action accepts an integer attachment ID and deletes the matching database row and file. The controller verifies a Joomla session t…
- UNSCOREDCVE-2026-97685public PoC
An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while supplying question or answer identifiers belonging to another user's survey. The REST survey-patching endpoint checks the…
- UNSCOREDCVE-2026-84464public PoC
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, zammad's External Data Source feature, used to look up records from an external system, did not properly verify whether a user was allowed to see a specific ticket, user, group…
- UNSCOREDCVE-2026-84460public PoC
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, any authenticated user can call the REST endpoint for getting a tag list and receive the tag names for the given ticket, regardless of whether they have access to that ticket. …
- UNSCOREDCVE-2026-63205public PoC
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline images referenced in the signature body. If a signature body contains an HTML img tag pointing to any exis…
- UNSCOREDCVE-2026-63204public PoC
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, an authenticated user with agent permissions can supply an arbitrary AI analytics run identifier to the ticket summarize endpoint and receive the AI provider error message stor…
- UNSCOREDCVE-2026-53626public PoC
GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item t…
- UNSCOREDCVE-2026-56728public PoC
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a broken access control vulnerability exists in Zammad's GraphQL API. An authenticated user can access taskbar item data belonging to another user by crafting a request with th…
- UNSCOREDCVE-2026-56724public PoC
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enfo…
- UNSCOREDCVE-2026-100177public PoC
The AIL Framework crawler task creation API (api_add_crawler_task) contained an insufficient authorization check when a user supplied a cookiejar UUID to attach to a one-shot or scheduled crawler task. The original code only verified that the cookiejar existed…
- UNSCOREDCVE-2026-97898
Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's …
- UNSCOREDCVE-2026-87739
An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized acces…
- UNSCOREDCVE-2026-90899
Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server ret…
- UNSCOREDCVE-2026-92419
WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' d…
- UNSCOREDCVE-2026-77426public PoC
Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segments/strategies assigns the Promise returned by hasPermission without awaiting it, allowing authentica…
- UNSCOREDCVE-2026-76910public PoC
Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone authorize creation in the destination project but do not verify access to the source project. Because …
- UNSCOREDCVE-2026-75101public PoC
An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or patch of pull requests in private repositories without authorization. Access tokens for raw pull reques…
- UNSCOREDCVE-2026-95683public PoC
In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraint…
- UNSCOREDCVE-2026-93556
The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for the recovery process is not validated against the user specified in that parameter. An unauthenticated…
- UNSCOREDCVE-2026-94393public PoC
When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actually belongs to the same event. As a result, a user who has editing rights on one event could potentia…
- UNSCOREDCVE-2026-94374public PoC
MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the code iterates over EventReport entries supplied in the resolved data and saves each one. Unlike the a…
- UNSCOREDCVE-2026-82685public PoC
Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm another user's email address, and so take over that account. A confirmation token issued to one user is a…
- UNSCOREDCVE-2026-70476public PoC
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/server/src/enterprise/routes/organization.route.ts and packages/server/src/enterprise/controllers/organi…
- UNSCOREDCVE-2026-69258public PoC
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoint accepted an overrideConfig object and unconditionally spread it into internal flowConfig and flowD…
- UNSCOREDCVE-2026-69250public PoC
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request…