CWE-639 · Authorization Bypass Through User-Controlled Key (page 14)
Page 14 of 29 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-31956 | Medium | 4.3 | 2026-04-24 | Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to version 4.4.1, any authentic… |
CVE-2026-6375 | | 2026-04-23 | A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls. Because PNR identifi… | |
CVE-2026-41279 | High | 7.5 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the text-to-speech generation endpoint (POST /api/v1/t… |
CVE-2026-41277 | High | 8.8 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, a Mass Assignment vulnerability in the DocumentStore c… |
CVE-2026-41267 | High | 8.1 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, an improper mass assignment (JSON injection) vulnerabi… |
CVE-2025-66286 | Medium | 4.7 | 2026-04-23 | An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Application… |
CVE-2018-25270 | Critical | 9.8 | 2026-04-22 | ThinkPHP 5.0.23 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by invoking functions throug… |
CVE-2026-6355 | Medium | 6.5 | 2026-04-22 | A vulnerability in the web application allows unauthorized users to access and manipulate sensitive data across different tenants by exploiting insecure direct… |
CVE-2026-5750 | | 2026-04-22 | An insecure direct object reference (IDOR) vulnerability in the Fullstep V5 registration process allows authenticated users to access data belonging to other r… | |
CVE-2026-41127 | Medium | 6.5 | 2026-04-22 | BigBlueButton is an open-source virtual classroom. Versions prior to 3.0.24 have a missing authorization that allows viewers to inject/overwrite captions Versi… |
CVE-2026-5845 | Critical | 9.6 | 2026-04-21 | An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authenticated attacker to acc… |
CVE-2026-3307 | Low | 2.7 | 2026-04-21 | An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the sec… |
CVE-2026-40907 | Medium | 6.5 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, the endpoint `plugin/Live/view/Live_restreams/list.json.php` contains an Insecure Dir… |
CVE-2026-40867 | | 2026-04-21 | Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, a broken access control vulnerability in the helpdesk attachment viewer al… | |
CVE-2026-40866 | | 2026-04-21 | Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document upload endpoi… | |
CVE-2026-40865 | | 2026-04-21 | Horilla is a free and open source Human Resource Management System (HRMS). In 1.5.0, an insecure direct object reference in the employee document viewer allows… | |
CVE-2026-5652 | Critical | 9.0 | 2026-04-21 | An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modif… |
CVE-2026-40591 | High | 7.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the phone-conversation creation flow accepts attacker-controlled `custo… |
CVE-2026-40590 | Medium | 4.3 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the Change Customer modal exposes a “Create a new customer” flow via PO… |
CVE-2026-40589 | High | 7.6 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, a low-privileged agent can edit a visible customer and add an email add… |
CVE-2026-40570 | | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, the `load_customer_info` action in `POST /conversation/ajax` returns co… | |
CVE-2026-39386 | High | 8.8 | 2026-04-21 | Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1, any authenticated user ca… |
CVE-2025-66954 | Medium | 6.5 | 2026-04-20 | A vulnerability exists in the Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to enumerate valid usernames and their as… |
CVE-2026-40896 | Medium | 6.5 | 2026-04-20 | OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject a… |
CVE-2026-6614 | Medium | 6.3 | 2026-04-20 | A security flaw has been discovered in TransformerOptimus SuperAGI up to 0.0.14. Affected by this vulnerability is the function get_project/update_project/get_… |
CVE-2026-6613 | Medium | 6.3 | 2026-04-20 | A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Affected is the function delete_agent/stop_schedule/get_schedule_data of the file s… |
CVE-2026-6612 | Medium | 6.3 | 2026-04-20 | A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This impacts the function get_agent_execution/update_agent_execution of the file su… |
CVE-2026-6586 | Medium | 6.3 | 2026-04-20 | A vulnerability was identified in TransformerOptimus SuperAGI up to 0.0.14. Impacted is the function get_budget/update_budget of the file superagi/controllers/… |
CVE-2026-6585 | Medium | 5.4 | 2026-04-20 | A vulnerability was determined in TransformerOptimus SuperAGI up to 0.0.14. This issue affects the function update_organisation of the file superagi/controller… |
CVE-2026-6584 | Medium | 5.4 | 2026-04-20 | A vulnerability was found in TransformerOptimus SuperAGI up to 0.0.14. This vulnerability affects the function update_user of the file superagi/controllers/use… |
CVE-2026-6583 | Medium | 5.4 | 2026-04-19 | A vulnerability has been found in TransformerOptimus SuperAGI up to 0.0.14. This affects the function delete_api_key/edit_api_key of the file superagi/controll… |
CVE-2026-6571 | Medium | 6.3 | 2026-04-19 | A weakness has been identified in kodcloud KodExplorer up to 4.52. Affected by this vulnerability is the function roleGroupAction of the file /app/controller/s… |
CVE-2026-6570 | Low | 2.7 | 2026-04-19 | A security flaw has been discovered in kodcloud KodExplorer up to 4.52. Affected is the function initInstall of the file /app/controller/systemMember.class.php… |
CVE-2026-40480 | | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/person/{personId} endpoint loads and returns person records with… | |
CVE-2026-5234 | Medium | 5.3 | 2026-04-17 | The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.3.2. The vulnerability exists beca… |
CVE-2026-3605 | High | 8.1 | 2026-04-17 | An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, re… |
CVE-2026-40308 | | 2026-04-16 | My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mc_ajax_mcjs_action AJAX endpoint, registered for unauthentica… | |
CVE-2026-4160 | Medium | 5.3 | 2026-04-16 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Referen… |
CVE-2026-40784 | High | 8.1 | 2026-04-15 | Authorization Bypass Through User-Controlled Key vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Acces… |
CVE-2026-40737 | Medium | 5.3 | 2026-04-15 | Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exploiting Incorrectly Configured Access C… |
CVE-2026-5617 | High | 8.8 | 2026-04-15 | The Login as User plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3. This is due to the handle_return_to_a… |
CVE-2026-1541 | Medium | 4.3 | 2026-04-15 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to th… |
CVE-2026-34602 | High | 7.1 | 2026-04-14 | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable to Insecure Direct… |
CVE-2026-34370 | Medium | 6.5 | 2026-04-14 | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains an Insecure Direct Object Reference (ID… |
CVE-2026-34213 | Medium | 5.4 | 2026-04-14 | Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost… |
CVE-2026-38532 | High | 8.1 | 2026-04-14 | A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to… |
CVE-2026-38530 | High | 8.1 | 2026-04-14 | A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to a… |
CVE-2026-38529 | High | 8.8 | 2026-04-14 | A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrari… |
CVE-2025-13822 | Medium | 5.3 | 2026-04-14 | MCPHub in versions below 0.11.0 is vulnerable to authentication bypass. Some endpoints are not protected by authentication middleware, allowing an unauthentica… |
CVE-2026-25654 | High | 8.8 | 2026-04-14 | A vulnerability has been identified in SINEC NMS (All versions < V4.0 SP3). Affected products do not properly validate user authorization when processing passw… |
CVE-2026-33740 | Medium | 5.4 | 2026-04-13 | EspoCRM is an open source customer relationship management application. In versions 9.3.3 and below, the POST /api/v1/Email/importEml endpoint contains an Inse… |
CVE-2026-40043 | Medium | 6.5 | 2026-04-13 | Pachno 1.0.6 contains an authentication bypass vulnerability in the runSwitchUser() action that allows authenticated low-privilege users to escalate privileges… |
CVE-2026-3371 | Medium | 4.3 | 2026-04-11 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin… |
CVE-2026-40252 | High | 8.1 | 2026-04-10 | FastGPT is an AI Agent building platform. Prior to 4.14.10.4, Broken Access Control vulnerability (IDOR/BOLA) allows any authenticated team to access and execu… |
CVE-2026-33736 | Medium | 6.5 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authenticated user (including ROLE_STUDENT) can enumerate all platform users and access p… |
CVE-2026-33703 | Medium | 6.5 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the /social-network/personal-data… |
CVE-2026-33702 | High | 7.1 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an Insecure Direct Object Reference (IDOR) vulnerability in… |
CVE-2026-33141 | Medium | 6.5 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the REST API stats endpoint allow… |
CVE-2026-32930 | High | 7.1 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook evaluat… |
CVE-2026-32894 | High | 7.1 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the gradebook result… |
CVE-2026-29002 | High | 7.2 | 2026-04-10 | CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_leve… |
CVE-2026-39942 | High | 8.5 | 2026-04-09 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, the PATCH /files/{id} endpoint accepts a user-controlled fil… |
CVE-2026-5842 | High | 7.3 | 2026-04-09 | A security vulnerability has been detected in decolua 9router up to 0.3.47. The impacted element is an unknown function of the file /api of the component Admin… |
CVE-2026-3568 | Medium | 4.3 | 2026-04-09 | The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the update_… |
CVE-2026-4398 | Medium | 5.4 | 2026-04-08 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain cond… |
CVE-2026-2104 | Medium | 4.3 | 2026-04-08 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have all… |
CVE-2026-5875 | Medium | 4.3 | 2026-04-08 | Policy bypass in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security sev… |
CVE-2026-35478 | High | 8.3 | 2026-04-08 | InvenTree is an Open Source Inventory Management System. From 0.16.0 to before 1.2.7, any authenticated InvenTree user can create a valid API token attributed… |
CVE-2026-35165 | Medium | 6.3 | 2026-04-08 | LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research… |
CVE-2026-34985 | Medium | 6.3 | 2026-04-08 | LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research… |
CVE-2026-32589 | High | 7.4 | 2026-04-08 | A flaw was found in Red Hat Quay's container image upload process. An authenticated user with push access to any repository on the registry can interfere with… |
CVE-2026-35023 | Medium | 4.3 | 2026-04-08 | Wimi Teamwork On-Premises versions prior to 8.2.0 contain an insecure direct object reference vulnerability in the preview.php endpoint where the item_id param… |
CVE-2026-39616 | Medium | 5.3 | 2026-04-08 | Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured A… |
CVE-2026-39526 | Medium | 5.4 | 2026-04-08 | Authorization Bypass Through User-Controlled Key vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-39510 | Low | 2.7 | 2026-04-08 | Authorization Bypass Through User-Controlled Key vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Exploiting… |
CVE-2026-4654 | Medium | 5.3 | 2026-04-08 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and includi… |
CVE-2026-4330 | Medium | 4.3 | 2026-04-08 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to authorization bypass through user-controlled key in all versions up t… |
CVE-2026-5167 | Medium | 5.3 | 2026-04-08 | The Masteriyo LMS – Online Course Builder for eLearning, LMS & Education plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key… |
CVE-2026-39374 | Medium | 6.5 | 2026-04-07 | Plane is an an open-source project management tool. Prior to 1.3.0, the IssueBulkUpdateDateEndpoint allows a project member (ADMIN or MEMBER) to modify the sta… |
CVE-2026-39354 | Medium | 6.5 | 2026-04-07 | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.66.2, an authenticated authorization flaw in Scoold allows any logged-in, low-privilege… |
CVE-2026-39331 | High | 8.1 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an authenticated API user can modify any family record's state without proper authorizati… |
CVE-2026-39384 | High | 7.6 | 2026-04-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limit_user_customer_visibility… |
CVE-2026-35584 | Medium | 6.5 | 2026-04-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id… |
CVE-2026-35489 | High | 7.3 | 2026-04-07 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint… |
CVE-2026-5465 | High | 8.8 | 2026-04-07 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inc… |
CVE-2026-35183 | High | 7.1 | 2026-04-06 | Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature. It is l… |
CVE-2026-35173 | Medium | 6.5 | 2026-04-06 | Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users… |
CVE-2026-35045 | High | 8.1 | 2026-04-06 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the PUT /api/recipe/batch_update/ endpoint… |
CVE-2026-34444 | Critical | 10.0 | 2026-04-06 | Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed thro… |
CVE-2026-31150 | Medium | 4.3 | 2026-04-06 | Incorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the shipping/receiving role to view the truck's dashboard resources. |
CVE-2026-4896 | High | 8.1 | 2026-04-04 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object R… |
CVE-2026-25197 | Critical | 9.1 | 2026-04-03 | A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call. |
CVE-2026-28736 | Medium | 4.3 | 2026-04-03 | ** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who… |
CVE-2026-34832 | Medium | 6.5 | 2026-04-02 | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.66.1, Scoold contains an authenticated authorization flaw in feedback deletion t… |
CVE-2026-34584 | Medium | 5.4 | 2026-04-02 | listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows u… |
CVE-2026-5326 | Medium | 5.3 | 2026-04-02 | A vulnerability was identified in SourceCodester Leave Application System 1.0. Impacted is an unknown function of the file /index.php?page=manage_user of the c… |
CVE-2026-5246 | Medium | 5.6 | 2026-04-02 | A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-… |
CVE-2026-5199 | | 2026-04-01 | A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster. Explo… | |
CVE-2026-3139 | Medium | 4.3 | 2026-03-31 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Ref… |
CVE-2026-32976 | Medium | 6.5 | 2026-03-31 | OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite co… |