CWE-639 · Authorization Bypass Through User-Controlled Key (page 10)
Page 10 of 23 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-32104 | Medium | 5.4 | 2026-03-11 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID f… |
CVE-2026-32103 | Medium | 6.8 | 2026-03-11 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/create-reset-link endp… |
CVE-2026-32097 | High | 8.8 | 2026-03-11 | PingPong is a platform for using large language models (LLMs) for teaching and learning. Prior to 7.27.2, an authenticated user may be able to retrieve or dele… |
CVE-2026-31874 | Critical | 9.8 | 2026-03-11 | Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the application does not properly validate… |
CVE-2019-25487 | Critical | 9.8 | 2026-03-11 | SAPIDO RB-1732 V2.0.43 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitti… |
CVE-2026-31867 | Medium | 4.8 | 2026-03-11 | Craft Commerce is an ecommerce platform for Craft CMS. Prior to 4.11.0 and 5.6.0, An Insecure Direct Object Reference (IDOR) vulnerability exists in Craft Comm… |
CVE-2025-67298 | High | 8.1 | 2026-03-11 | An issue in ClasroomIO before v.0.2.6 allows a remote attacker to escalate privileges via the endpoints /api/verify and /rest/v1/profile |
CVE-2026-1992 | High | 8.8 | 2026-03-11 | The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Insecure Direct Object Reference in versions 8.6.0 through 9.0.2. This is d… |
CVE-2026-2918 | Medium | 6.4 | 2026-03-11 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.21.0 via the `ha_… |
CVE-2026-2917 | Medium | 5.4 | 2026-03-11 | The Happy Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.21.0 via the `ha_… |
CVE-2026-1753 | Medium | 6.8 | 2026-03-11 | The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to update arbitrary boole… |
CVE-2026-3453 | High | 8.1 | 2026-03-11 | The ProfilePress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.16.11. This is due to missing o… |
CVE-2026-31832 | Medium | 5.4 | 2026-03-10 | Umbraco is an ASP.NET CMS. From 14.0.0 to before 16.5.1 and 17.2.2, A broken object-level authorization vulnerability exists in a backoffice API endpoint that… |
CVE-2026-31820 | Medium | 6.5 | 2026-03-10 | Sylius is an Open Source eCommerce Framework on Symfony. An authenticated Insecure Direct Object Reference (IDOR) vulnerability exists in multiple shop LiveCom… |
CVE-2026-30954 | Medium | 4.3 | 2026-03-10 | LinkAce is a self-hosted archive to collect website links. In 2.1.0 and earlier, the processTaxonomy() method in LinkRepository.php allows authenticated users… |
CVE-2026-3306 | Medium | 4.3 | 2026-03-10 | An improper authorization vulnerability was identified in GitHub Enterprise Server that allowed a user with read access to a repository and write access to a p… |
CVE-2026-30969 | Critical | 9.1 | 2026-03-10 | Coral Server is open collaboration infrastructure that enables communication, coordination, trust and payments for The Internet of Agents. Prior to 1.1.0, Cora… |
CVE-2026-30959 | Medium | 5.0 | 2026-03-10 | OneUptime is a solution for monitoring and managing online services. The resend-verification-code endpoint allows any authenticated user to trigger a verificat… |
CVE-2026-30945 | High | 7.1 | 2026-03-10 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the DELETE /studiocms_api/dashboard/api-tokens endpoint… |
CVE-2026-30944 | High | 8.8 | 2026-03-10 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows… |
CVE-2026-30927 | Medium | 5.4 | 2026-03-10 | Admidio is an open-source user management solution. Prior to 5.0.6, in modules/events/events_function.php, the event participation logic allows any user who ca… |
CVE-2026-30920 | High | 8.6 | 2026-03-10 | OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and ins… |
CVE-2026-30885 | Medium | 5.3 | 2026-03-10 | WWBN AVideo is an open source video platform. Prior to 25.0, the /objects/playlistsFromUser.json.php endpoint returns all playlists for any user without requir… |
CVE-2026-28433 | Medium | 4.3 | 2026-03-10 | Misskey is an open source, federated social media platform. All Misskey servers running versions 10.93.0 and later, but prior to 2026.3.1, contain a vulnerabil… |
CVE-2025-62166 | High | 7.5 | 2026-03-09 | FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed… |
CVE-2026-30857 | Medium | 5.3 | 2026-03-07 | WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval. Prior to version 0.3.0, a cross-tenant authorization bypas… |
CVE-2026-30825 | Unrated | | 2026-03-07 | hoppscotch is an open source API development ecosystem. Prior to version 2026.2.1, the DELETE /v1/access-tokens/revoke endpoint allows any authenticated user t… |
CVE-2026-30823 | High | 8.8 | 2026-03-07 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, there is an IDOR vulnerability, leading to ac… |
CVE-2026-30231 | Medium | 5.3 | 2026-03-06 | Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the raw and direct file routes onl… |
CVE-2026-30230 | High | 7.5 | 2026-03-06 | Flare is a Next.js-based, self-hostable file sharing platform that integrates with screenshot tools. Prior to version 1.7.2, the thumbnail endpoint does not va… |
CVE-2026-30843 | Medium | 6.5 | 2026-03-06 | Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 have a critical Insecure Direct Object Reference (IDOR) issue which could allow u… |
CVE-2026-25877 | Medium | 6.5 | 2026-03-06 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to version 4.8.1, the appl… |
CVE-2026-28469 | High | 7.5 | 2026-03-05 | OpenClaw versions prior to 2026.2.14 contain a webhook routing vulnerability in the Google Chat monitor component that allows cross-account policy context misr… |
CVE-2026-27898 | Medium | 5.4 | 2026-03-04 | Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, an authenticated regular use… |
CVE-2026-29069 | Medium | 5.3 | 2026-03-04 | Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() endpoint is accessible to unauthenticated… |
CVE-2026-28782 | Medium | 4.3 | 2026-03-04 | Craft is a content management system (CMS). Prior to 5.9.0-beta.1 and 4.17.0-beta.1, the "Duplicate" entry action does not properly verify if the user has perm… |
CVE-2026-28781 | Medium | 6.5 | 2026-03-04 | Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the entry creation process allows for Mass Assignment of the authorId attr… |
CVE-2026-28696 | High | 7.5 | 2026-03-04 | Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, the GraphQL directive @parseRefs, intended to parse internal reference tag… |
CVE-2026-0020 | High | 8.4 | 2026-03-02 | In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass. Th… |
CVE-2026-28361 | Medium | 6.3 | 2026-03-02 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.3, the MCP token service did not validate token ownership, allowing a Creator… |
CVE-2025-58402 | High | 7.5 | 2026-03-02 | The CGM CLININET application uses direct, sequential object identifiers "MessageID" without proper authorization checks. By modifying the parameter in the GET… |
CVE-2026-28354 | Medium | 6.5 | 2026-02-27 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 #59, collection item operations are vulnerable to authorization flaws, allowing… |
CVE-2026-27793 | Medium | 6.5 | 2026-02-27 | Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.1.0, the `GET /api/v1/user/:id` endpoint returns t… |
CVE-2026-25147 | High | 7.1 | 2026-02-27 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, in `portal/portal_payment.php`… |
CVE-2026-1558 | Medium | 5.3 | 2026-02-27 | The WP Recipe Maker plugin for WordPress is vulnerable to an Insecure Direct Object Reference (IDOR) in versions up to, and including, 10.3.2. This is due to t… |
CVE-2026-28225 | Medium | 5.3 | 2026-02-26 | Manyfold is an open source, self-hosted web application for managing a collection of 3d models, particularly focused on 3d printing. Prior to version 0.133.1… |
CVE-2026-28217 | Medium | 6.5 | 2026-02-26 | hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query accepts an arbitrary collection ID and re… |
CVE-2026-28216 | High | 8.3 | 2026-02-26 | hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, any logged-in user can read, modify or delete another user's personal enviro… |
CVE-2026-27839 | Medium | 4.3 | 2026-02-26 | wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, three `nutritional_values` action endpoints fetch objects via `Mo… |
CVE-2026-27838 | Low | 3.1 | 2026-02-26 | wger is a free, open-source workout and fitness manager. Five routine detail action endpoints check a cache before calling `self.get_object()`. In versions up… |
CVE-2026-27835 | Medium | 4.3 | 2026-02-26 | wger is a free, open-source workout and fitness manager. In versions up to and including 2.4, `RepetitionsConfigViewSet` and `MaxRepetitionsConfigViewSet` retu… |
CVE-2026-27449 | High | 7.5 | 2026-02-26 | Umbraco Engage is a business intelligence platform. A vulnerability has been identified in Umbraco Engage prior to versions 16.2.1 and 17.1.1 where certain API… |
CVE-2026-26973 | Medium | 4.3 | 2026-02-26 | Discourse is an open source discussion platform. Versions prior to 2025.12.2, 2026.1.1, and 2026.2.0 have an IDOR (Insecure Direct Object Reference) in `Review… |
CVE-2026-26265 | High | 7.5 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, an IDOR vulnerability in the directory items endpoint all… |
CVE-2026-26078 | High | 7.5 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, when the `patreon_webhook_secret` site setting is blank… |
CVE-2026-27943 | Medium | 6.5 | 2026-02-26 | OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, the eye exam (e… |
CVE-2026-25930 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Layout-Based Form (LBF) pr… |
CVE-2026-25929 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the document controller’s `pat… |
CVE-2026-25927 | High | 7.1 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the DICOM viewer state API (e… |
CVE-2026-25220 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Message Center accepts the… |
CVE-2026-27705 | Medium | 6.5 | 2026-02-25 | Plane is an an open-source project management tool. Prior to version 1.2.2, the `ProjectAssetEndpoint.patch()` method in `apps/api/plane/app/views/asset/v2.py`… |
CVE-2026-3185 | Medium | 5.3 | 2026-02-25 | A vulnerability was found in feiyuchuixue sz-boot-parent up to 1.3.2-beta. Affected is an unknown function of the file /api/admin/sys-message/ of the component… |
CVE-2025-14742 | Medium | 4.3 | 2026-02-25 | The WP Recipe Maker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ajax_search_recipes' and 'ajax_… |
CVE-2025-40541 | Critical | 9.1 | 2026-02-24 | An Insecure Direct Object Reference (IDOR) vulnerability exists in Serv-U, which when exploited, gives a malicious actor the ability to execute native code as… |
CVE-2026-2698 | Medium | 6.5 | 2026-02-23 | An improper access control vulnerability exists where an authenticated user could access areas outside of their authorized scope. |
CVE-2026-2697 | Medium | 6.3 | 2026-02-23 | An Indirect Object Reference (IDOR) in Security Center allows an authenticated remote attacker to escalate privileges via the 'owner' parameter. |
CVE-2026-2997 | Medium | 5.4 | 2026-02-23 | Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. After obtaining a course ID, authenticated remote attackers to modify… |
CVE-2025-70833 | Critical | 9.4 | 2026-02-20 | An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the administrator) and f… |
CVE-2025-15582 | Medium | 5.4 | 2026-02-20 | A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update of the component Product Management Mod… |
CVE-2026-24950 | High | 7.5 | 2026-02-20 | Authorization Bypass Through User-Controlled Key vulnerability in themeplugs Authorsy authorsy allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-22383 | High | 7.5 | 2026-02-20 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Exploiti… |
CVE-2025-69394 | High | 7.5 | 2026-02-20 | Authorization Bypass Through User-Controlled Key vulnerability in cnvrse Cnvrse cnvrse allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-68514 | Medium | 6.5 | 2026-02-20 | Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly… |
CVE-2025-68051 | High | 7.5 | 2026-02-20 | Authorization Bypass Through User-Controlled Key vulnerability in Shiprocket Shiprocket shiprocket allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2026-26016 | High | 8.1 | 2026-02-19 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in… |
CVE-2025-9062 | High | 7.3 | 2026-02-19 | Authorization Bypass Through User-Controlled Key vulnerability in MeCODE Informatics and Engineering Services Ltd. Envanty allows Parameter Injection. This is… |
CVE-2026-1219 | Medium | 5.3 | 2026-02-19 | The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to… |
CVE-2026-25324 | Medium | 5.3 | 2026-02-19 | Authorization Bypass Through User-Controlled Key vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Con… |
CVE-2026-25005 | Medium | 5.3 | 2026-02-19 | Authorization Bypass Through User-Controlled Key vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows Exploiting Incorrectly Configu… |
CVE-2026-25120 | Low | 2.7 | 2026-02-19 | Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository… |
CVE-2025-13842 | Medium | 5.3 | 2026-02-19 | The Breadcrumb NavXT plugin for WordPress is vulnerable to authorization bypass through user-controlled key in versions up to and including 7.5.0. This is due… |
CVE-2025-70063 | Medium | 6.5 | 2026-02-18 | The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability. The application f… |
CVE-2026-2230 | Medium | 4.3 | 2026-02-18 | The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 via the handle_ajax_… |
CVE-2026-1436 | Medium | 6.5 | 2026-02-18 | Improper Access Control (IDOR) in the Graylog API, version 2.2.3, which occurs when modifying the user ID in the URL. An authenticated user can access other us… |
CVE-2025-12071 | Medium | 4.3 | 2026-02-18 | The Frontend User Notes plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'funp_ajax_m… |
CVE-2026-1987 | Medium | 5.4 | 2026-02-14 | The Scheduler Widget plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 0.1.6. This is due to the `sc… |
CVE-2026-1619 | High | 8.3 | 2026-02-13 | Authorization Bypass Through User-Controlled Key vulnerability in Universal Software Inc. FlexCity/Kiosk allows Exploitation of Trusted Identifiers. This issu… |
CVE-2025-69752 | Medium | 4.3 | 2026-02-12 | An issue in the "My Details" user profile functionality of Ideagen Q-Pulse 7.1.0.32 allows an authenticated user to view other users' profile information by mo… |
CVE-2025-13004 | Medium | 6.3 | 2026-02-12 | Authorization Bypass Through User-Controlled Key vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Package allows Manipulating User-Control… |
CVE-2026-1080 | Medium | 4.3 | 2026-02-11 | GitLab has remediated an issue in GitLab EE affecting all versions from 16.7 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain cond… |
CVE-2025-14594 | Low | 3.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain… |
CVE-2025-15096 | High | 8.8 | 2026-02-11 | The 'Videospirecore Theme Plugin' plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.6… |
CVE-2025-10912 | Medium | 5.4 | 2026-02-11 | Authorization Bypass Through User-Controlled Key vulnerability in Saastech Cleaning and Internet Services Inc. TemizlikYolda allows Manipulating User-Controlle… |
CVE-2026-25530 | Medium | 4.3 | 2026-02-10 | Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing… |
CVE-2025-7347 | High | 8.8 | 2026-02-10 | Authorization Bypass Through User-Controlled Key vulnerability in Dinibh Puzzle Software Solutions Dinibh Patrol Tracking System allows Exploitation of Trusted… |
CVE-2025-12063 | Medium | 5.7 | 2026-02-10 | An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions. |
CVE-2025-15147 | Medium | 4.3 | 2026-02-10 | The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version… |
CVE-2026-25497 | High | 8.8 | 2026-02-09 | Craft is a platform for creating digital experiences. In Craft versions from 4.0.0-RC1 to before 4.17.0-beta.1 and 5.9.0-beta.1, there is a Privilege Escalatio… |
CVE-2026-24900 | Medium | 6.5 | 2026-02-09 | MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submis… |
CVE-2026-25567 | Medium | 4.3 | 2026-02-07 | WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an authorId from the req… |