CWE-639 · Authorization Bypass Through User-Controlled Key (page 10)
Page 10 of 29 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6212 | High | 8.8 | 2026-07-10 | Authorization bypass through User-Controlled key vulnerability in Teracity Software Technologies Inc. TeraMIS allows Privilege Abuse. This issue affects TeraM… |
CVE-2026-61460 | High | 8.8 | 2026-07-10 | Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController, OrganizationController, QuoteControlle… |
CVE-2026-55516 | High | 7.7 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks access to the current maintenance… |
CVE-2026-55478 | Medium | 5.4 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licenses checks whether the caller can edit kits but does not aut… |
CVE-2026-55670 | | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 4.15.1, ZITADEL's event store validation can retain the original resource owner for a deleted… | |
CVE-2026-59190 | | 2026-07-10 | grav-plugin-admin is an HTML user interface that provides a way to configure Grav and create and modify pages. In 1.10.52 and earlier, an authenticated attacke… | |
CVE-2026-2398 | High | 8.8 | 2026-07-10 | Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows Privilege Escalation. This issue affects Mob… |
CVE-2026-56765 | Critical | 9.8 | 2026-07-10 | Vikunja before 2.2.1 contains an authorization flaw where the LinkSharing.ReadAll endpoint exposes share hashes to users with read access, enabling permission… |
CVE-2026-41878 | | 2026-07-10 | R-SOFT DMS is vulnerable to Insecure Direct Object Reference (IDOR) attack in multiple file download endpoints. The application fetches files from the database… | |
CVE-2026-6802 | Medium | 5.3 | 2026-07-10 | The Easy Upload Files During Checkout plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 3.0.1. This is due to mis… |
CVE-2026-12400 | Medium | 4.3 | 2026-07-10 | The FlowForms – Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.1… |
CVE-2026-55604 | High | 8.6 | 2026-07-09 | DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-su… |
CVE-2026-51925 | High | 8.1 | 2026-07-09 | A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a remote attacker to execute arbitrary code via the dfm-menu_rep… |
CVE-2026-51924 | High | 8.1 | 2026-07-09 | An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component |
CVE-2026-51923 | High | 8.1 | 2026-07-09 | An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c allowing a remote attacker to execute arbitrary code via the u… |
CVE-2026-59817 | Medium | 5.3 | 2026-07-09 | Ghost is a Node.js content management system. From 6.27.0 before 6.44.0, Ghost's public donation checkout flow allowed an unauthenticated attacker to control d… |
CVE-2026-59216 | High | 7.7 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool… |
CVE-2026-59215 | Low | 3.1 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, channel thread parent and reply handling did not bind pa… |
CVE-2026-15191 | Medium | 6.3 | 2026-07-09 | A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettle/sendportal-core/src/Http/Requests/Cam… |
CVE-2026-1989 | High | 7.5 | 2026-07-09 | Authorization bypass through User-Controlled key vulnerability in PAVO Financial Technology Solutions Inc. PAVO Pay allows Exploitation of Trusted Identifiers… |
CVE-2026-12433 | Medium | 4.3 | 2026-07-09 | The Hydra Booking – Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and inc… |
CVE-2026-13450 | Medium | 5.3 | 2026-07-09 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Insecure Direct Object Re… |
CVE-2026-12418 | Medium | 5.3 | 2026-07-09 | The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct O… |
CVE-2026-5523 | High | 8.8 | 2026-07-09 | The Divi Form Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 5.1.8. This is due to the update_user() fun… |
CVE-2026-54590 | Medium | 5.9 | 2026-07-08 | AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Vers… |
CVE-2026-35210 | High | 7.1 | 2026-07-08 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to 7.260326.0, an authorization bypass vulnerability… |
CVE-2026-60104 | High | 8.7 | 2026-07-08 | Bitwarden Server before 2026.6.0 does not verify that the email in a POST /auth-requests/admin-request body belongs to the authenticated caller, allowing a low… |
CVE-2026-15036 | Medium | 4.3 | 2026-07-08 | A vulnerability was determined in Harness up to 2.28.2. This vulnerability affects the function getAuthorizedSpaces of the file app/api/controller/gitspace/lis… |
CVE-2026-59253 | Medium | 5.0 | 2026-07-08 | n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to folders in other projects. Attackers can… |
CVE-2026-5459 | Medium | 5.3 | 2026-07-08 | The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct O… |
CVE-2026-3688 | High | 8.1 | 2026-07-08 | The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version… |
CVE-2026-55429 | High | 8.7 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, `UpsertWorkspaceAp… |
CVE-2026-55418 | High | 8.6 | 2026-07-07 | FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read a… |
CVE-2026-54602 | | 2026-07-07 | FastGPT is a knowledge-based AI application platform. Prior to 4.15.0, GET /api/core/ai/record/getRecord authenticates the caller but loads LLM request and res… | |
CVE-2026-53729 | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, any authenticated user can download (/exportCenter/download/{id}), delete (/… | |
CVE-2026-50530 | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, a share mode chart data interface only validates that sceneId matches the re… | |
CVE-2026-49296 | Medium | 6.5 | 2026-07-07 | Before apache-airflow 3.3.0, a user authorized to read one Dag could disclose the source of other Dags co-located in the same source file. `GET /api/v2/dagSour… |
CVE-2026-5799 | High | 7.5 | 2026-07-07 | Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifie… |
CVE-2026-5730 | High | 7.5 | 2026-07-07 | Authorization bypass through User-Controlled key vulnerability in Idvlabs Software and Consulting Services Inc. Ontime allows Exploitation of Trusted Identifie… |
CVE-2026-57870 | | 2026-07-07 | Broken object-level access control on the Template API in MicroRealEstate allows attackers to retrieve document templates used by other organizations without a… | |
CVE-2026-57869 | | 2026-07-07 | Broken object-level access controls and the use of a deterministic pattern during random ID generation in MicroRealEstate allows attackers to access documents… | |
CVE-2026-57868 | | 2026-07-07 | MicroRealEstate is affected by broken object-level access controls in PDF generator functionality. This issue affects MicroRealEstate: through 1.0.0-alpha3. | |
CVE-2026-34044 | High | 7.7 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, the Logs::mount() component looks… |
CVE-2026-34037 | Critical | 9.9 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the cloneTo() Livewire action in R… |
CVE-2026-53644 | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticated clients to both read and reset API ke… | |
CVE-2026-53643 | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized ac… | |
CVE-2026-34167 | Medium | 5.0 | 2026-07-06 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the ActivityMonitor Livewire compo… |
CVE-2026-59712 | High | 8.1 | 2026-07-06 | Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows incl… |
CVE-2026-12686 | | 2026-07-06 | An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the… | |
CVE-2026-49099 | Medium | 5.3 | 2026-07-06 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerabil… |
CVE-2026-48206 | Medium | 5.3 | 2026-07-06 | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel JIRA component. The camel-jira producers read their… |
CVE-2026-46585 | High | 7.5 | 2026-07-06 | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component. The camel-lucene producer reads th… |
CVE-2026-46453 | Medium | 5.3 | 2026-07-06 | Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client. The camel-elasticsearch-r… |
CVE-2026-14793 | Medium | 4.3 | 2026-07-06 | A vulnerability was detected in Craft CMS up to 4.18.0.1. Affected is the function actionReorderSets of the file src/controllers/GlobalsController.php of the c… |
CVE-2026-14753 | High | 7.3 | 2026-07-05 | A vulnerability was detected in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. This impacts an unknown function of the file /PHP/objects/n… |
CVE-2026-28740 | High | 7.1 | 2026-07-03 | Gitea versions up to and including 1.26.2 allow Git LFS object reuse to authorize private source objects for users who have repository access but lack Code-uni… |
CVE-2026-27657 | High | 7.5 | 2026-07-03 | Gitea versions before 1.25.5 allow a user to change another user's primary email address. |
CVE-2026-25782 | Medium | 5.3 | 2026-07-03 | Gitea versions before 1.25.5 look up tracked-time entries by time ID without scoping the lookup to the issue in the request URL, allowing deletion attempts to… |
CVE-2026-14608 | Medium | 4.3 | 2026-07-03 | A security vulnerability has been detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown… |
CVE-2026-14614 | Medium | 5.4 | 2026-07-03 | A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a del… |
CVE-2026-59234 | | 2026-07-03 | Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php)… | |
CVE-2026-11900 | Medium | 4.3 | 2026-07-03 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via th… |
CVE-2026-9180 | Medium | 5.3 | 2026-07-03 | The MotoPress Appointment Booking plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to, and including… |
CVE-2026-59100 | Medium | 5.0 | 2026-07-02 | LobeChat through 2.2.9 contains a broken object level authorization vulnerability that allows authenticated attackers to access and modify other users' chat-gr… |
CVE-2026-59098 | Medium | 6.5 | 2026-07-02 | LobeChat through 2.2.9 contains a broken access control vulnerability in the retrieval-augmented-generation semantic search functionality that allows authentic… |
CVE-2026-58580 | Medium | 5.9 | 2026-07-02 | LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginSt… |
CVE-2026-58653 | Medium | 4.3 | 2026-07-02 | PraisonAI before 0.1.7 fails to validate that project_id in issue create and update request bodies belongs to the URL workspace. An attacker can create issues… |
CVE-2026-57680 | Medium | 6.5 | 2026-07-02 | Unauthenticated Insecure Direct Object References (IDOR) in Kirki <= 6.0.11 versions. |
CVE-2026-9188 | Medium | 5.3 | 2026-07-02 | The Appointment Bookings for Zoom GoogleMeet and more – Wappointment plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up… |
CVE-2026-12657 | Medium | 5.3 | 2026-07-02 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up t… |
CVE-2026-11896 | Medium | 5.3 | 2026-07-02 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14… |
CVE-2026-5348 | Medium | 5.3 | 2026-07-02 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to… |
CVE-2026-50283 | | 2026-07-01 | Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsCo… | |
CVE-2026-49858 | Medium | 5.9 | 2026-07-01 | API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. In versions from 2.6.0 prior to 4.1.29, 4.2.26, and 4.3.12, a missing isCacheK… |
CVE-2026-5142 | Medium | 6.5 | 2026-07-01 | A flaw was found in foreman. Authenticated users with 'view_keypairs' permission can bypass taxonomy scoping, allowing them to download private SSH (Secure She… |
CVE-2026-5138 | Medium | 4.3 | 2026-07-01 | A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occu… |
CVE-2026-5135 | Medium | 6.5 | 2026-07-01 | A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup va… |
CVE-2026-53903 | High | 8.1 | 2026-07-01 | MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint… |
CVE-2026-10096 | Medium | 4.3 | 2026-07-01 | The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'page_id' parameter du… |
CVE-2026-12904 | Medium | 4.3 | 2026-07-01 | The Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and in… |
CVE-2026-11988 | Medium | 6.5 | 2026-07-01 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2026-56230 | High | 8.8 | 2026-06-30 | Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts the client-controlled x-limited-key-id header… |
CVE-2026-58447 | Medium | 6.5 | 2026-06-30 | Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to dele… |
CVE-2026-10140 | Critical | 9.6 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenti… |
CVE-2026-27956 | Medium | 4.3 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/servers/{server_uuid}… |
CVE-2026-27883 | Medium | 5.0 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the `GET /api/v1/deployments/{uuid… |
CVE-2026-27881 | Medium | 5.0 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/deployments/{uuid}` i… |
CVE-2026-14209 | Medium | 4.3 | 2026-06-30 | A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Adm… |
CVE-2026-12073 | Critical | 9.8 | 2026-06-30 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to… |
CVE-2026-34592 | High | 7.7 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, Coolify server and project lookups… |
CVE-2026-57498 | Critical | 9.6 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consiste… |
CVE-2026-57956 | Medium | 6.4 | 2026-06-29 | SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a… |
CVE-2026-57945 | Medium | 4.3 | 2026-06-29 | PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile info… |
CVE-2026-57943 | Medium | 5.9 | 2026-06-29 | LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that allows authenticated users to grant th… |
CVE-2026-56781 | Medium | 5.3 | 2026-06-29 | Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allows anonymous attackers to access hidden field data by supply… |
CVE-2026-56780 | High | 7.5 | 2026-06-29 | Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administ… |
CVE-2026-57341 | Medium | 6.5 | 2026-06-29 | Unauthenticated Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 versions. |
CVE-2026-57676 | Medium | 4.3 | 2026-06-29 | Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2026-13549 | Medium | 5.4 | 2026-06-29 | A security flaw has been discovered in CodeAstro Complaint Management System 1.0. The affected element is the function deletereport of the file application/con… |
CVE-2026-13534 | Medium | 5.0 | 2026-06-29 | A vulnerability was detected in CherryHQ cherry-studio up to 1.9.7. This affects the function sha256 of the file src/main/services/memory/MemoryService.ts of t… |