CWE-639 · Authorization Bypass Through User-Controlled Key (page 2)
Page 2 of 23 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14211 | Low | 3.8 | 2026-08-10 | The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the custo… |
CVE-2026-16957 | Low | 2.7 | 2026-08-09 | The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, al… |
CVE-2026-16953 | Medium | 4.8 | 2026-08-08 | The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a… |
CVE-2026-16574 | Medium | 5.4 | 2026-08-08 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the r… |
CVE-2026-48169 | High | 8.8 | 2026-08-07 | PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace is… |
CVE-2026-70561 | Medium | 6.5 | 2026-08-07 | TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts… |
CVE-2026-66058 | | 2026-08-07 | Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for a… | |
CVE-2026-16039 | Medium | 6.5 | 2026-08-07 | The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, includ… |
CVE-2026-15214 | Medium | 4.3 | 2026-08-07 | The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its deta… |
CVE-2026-70557 | Medium | 6.5 | 2026-08-06 | diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for… |
CVE-2026-67622 | Critical | 9.9 | 2026-08-06 | Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to ac… |
CVE-2026-64662 | Medium | 6.5 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from… |
CVE-2026-45414 | High | 8.5 | 2026-08-06 | Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organiza… |
CVE-2026-19111 | High | 8.1 | 2026-08-06 | Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow rem… |
CVE-2026-19066 | Medium | 4.3 | 2026-08-06 | A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unknown function of the file view_students… |
CVE-2026-19064 | Medium | 4.3 | 2026-08-06 | A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of the file /view.php… |
CVE-2026-15147 | Medium | 5.3 | 2026-08-06 | The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate th… |
CVE-2026-14842 | Medium | 5.3 | 2026-08-06 | The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated… |
CVE-2026-14306 | Medium | 4.3 | 2026-08-06 | The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated us… |
CVE-2026-13399 | High | 7.5 | 2026-08-06 | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticate… |
CVE-2026-10599 | High | 7.5 | 2026-08-06 | The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked a… |
CVE-2026-18275 | Medium | 6.5 | 2026-08-06 | Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segme… |
CVE-2026-18258 | High | 8.8 | 2026-08-06 | Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote a… |
CVE-2026-66692 | Medium | 4.3 | 2026-08-06 | Customer Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions. |
CVE-2026-65523 | High | 7.5 | 2026-08-06 | Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions. |
CVE-2026-28180 | Medium | 5.3 | 2026-08-06 | Unauthenticated Insecure Direct Object References (IDOR) in Mercado Pago payments for WooCommerce <= 8.9.0 versions. |
CVE-2025-11850 | Medium | 4.3 | 2026-08-06 | When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user… |
CVE-2026-14313 | Medium | 5.3 | 2026-08-06 | PeproDev WooCommerce Receipt Uploader (PeproDev WooCommerce Receipt Uploader WordPress plugin through 2.8.0 slug: pepro-bacs-receipt-upload-for-woocommerce), a… |
CVE-2026-9130 | High | 7.1 | 2026-08-05 | IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat histo… |
CVE-2026-48912 | Medium | 6.5 | 2026-08-05 | Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in the avatar-cleanup l… |
CVE-2026-71251 | Medium | 6.5 | 2026-08-05 | Akaunting's shared download route (app/Http/Controllers/Common/Uploads.php::download, reachable at uploads/{id}/download behind only generic auth middleware) f… |
CVE-2026-71242 | High | 8.3 | 2026-08-05 | Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and ot… |
CVE-2026-55739 | High | 8.3 | 2026-08-05 | Crater isolates data per company_id, and its Invoice/Estimate/Payment/Expense policies enforce both a Bouncer ability check and ->hasCompany(->company_id). Cus… |
CVE-2026-11454 | Medium | 6.5 | 2026-08-05 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and i… |
CVE-2026-16981 | Medium | 5.3 | 2026-08-05 | The DHL Shipping Germany for WooCommerce WordPress plugin before 4.0.1 does not perform any authorization check (no capability, nonce, login, or ownership chec… |
CVE-2026-16746 | Low | 2.7 | 2026-08-05 | The MultiVendorX WordPress plugin before 5.0.11 does not verify that the requested store belongs to the current user in one of its REST API endpoints, allowin… |
CVE-2026-18818 | Medium | 6.3 | 2026-08-04 | A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the… |
CVE-2026-70488 | Medium | 4.3 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write acces… |
CVE-2026-70476 | | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, several organization billing endpoints in packages/ser… | |
CVE-2026-69258 | | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the unauthenticated POST /api/v1/prediction/:id endpoi… | |
CVE-2026-69250 | | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-… | |
CVE-2026-16070 | Low | 2.7 | 2026-08-04 | The Brizy WordPress plugin before 2.8.19 does not properly verify authorization on the object being modified before updating a template's type meta, validatin… |
CVE-2026-18722 | Medium | 6.3 | 2026-08-04 | A vulnerability was found in diaowen DWSurvey up to 6.14.0. Impacted is the function in DwDeisgnSurveyController.devSurvey. of the file /api/dwsurvey/app/v6/dw… |
CVE-2026-46712 | | 2026-08-03 | Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper… | |
CVE-2026-18631 | Medium | 6.3 | 2026-08-03 | A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/jav… |
CVE-2026-69094 | Medium | 4.3 | 2026-08-03 | Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the save_temporary mode of mylist_function.php that allows authenticated us… |
CVE-2026-2346 | Critical | 9.8 | 2026-08-03 | Authorization bypass through User-Controlled key vulnerability in Menulux Software Inc. Mobile App allows Software Integrity Attack. This issue affects Mobile… |
CVE-2026-16565 | Medium | 4.3 | 2026-08-03 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify product ownership on its product-attribute RE… |
CVE-2026-16564 | Medium | 4.3 | 2026-08-03 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.9 does not verify order ownership on a REST endpoint that perfo… |
CVE-2026-15260 | Medium | 4.3 | 2026-08-03 | The GEO my WP WordPress plugin before 4.5.5.3 does not perform any ownership or capability check on two of its logged-in AJAX actions, allowing users with subs… |
CVE-2026-15231 | Low | 2.7 | 2026-08-03 | The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing… |
CVE-2026-68582 | Medium | 6.5 | 2026-08-02 | Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/… |
CVE-2025-71400 | High | 7.1 | 2026-08-02 | better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint that allows authenticated… |
CVE-2026-16291 | Medium | 4.3 | 2026-08-02 | The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authentica… |
CVE-2026-14938 | Medium | 4.3 | 2026-08-02 | The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is… |
CVE-2026-67342 | Critical | 9.8 | 2026-08-01 | ArcadeDB versions before 26.7.2 contain an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints that f… |
CVE-2026-67331 | High | 8.3 | 2026-08-01 | better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users… |
CVE-2026-67329 | High | 7.1 | 2026-08-01 | @better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription acti… |
CVE-2025-14073 | Medium | 5.3 | 2026-08-01 | The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versio… |
CVE-2026-14823 | Low | 2.2 | 2026-08-01 | The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with… |
CVE-2026-14197 | Low | 3.8 | 2026-08-01 | The Fluent Support WordPress plugin before 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer, allowing a restricted supp… |
CVE-2026-14195 | Low | 2.7 | 2026-08-01 | The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Co… |
CVE-2026-45330 | Medium | 4.9 | 2026-07-31 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verifica… |
CVE-2026-65981 | High | 7.1 | 2026-07-31 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with th… |
CVE-2026-17349 | Critical | 9.6 | 2026-07-31 | /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server… |
CVE-2026-17567 | Medium | 5.3 | 2026-07-31 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Referen… |
CVE-2026-8155 | Medium | 5.4 | 2026-07-31 | The BuddyPress WordPress plugin before 14.5.0 does not properly enforce authorization on its private messaging endpoints, allowing any authenticated user (Subs… |
CVE-2026-15209 | Medium | 6.5 | 2026-07-31 | The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can… |
CVE-2026-14927 | Low | 3.7 | 2026-07-31 | The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order docu… |
CVE-2026-14847 | Medium | 4.3 | 2026-07-31 | The Paid Membership Subscriptions WordPress plugin before 3.0.7 does not perform capability or nonce checks on one of its payment-related AJAX actions, allowi… |
CVE-2026-14843 | Medium | 5.3 | 2026-07-31 | The Events Made Easy WordPress plugin before 3.1.4 does not verify that the requester is authorized to modify the targeted record when handling an unauthentica… |
CVE-2026-12697 | Medium | 5.4 | 2026-07-31 | The wpForo Forum WordPress plugin before 3.1.2 does not verify that an AI chat conversation belongs to the requesting user before deleting its messages, allowi… |
CVE-2026-12376 | Medium | 4.3 | 2026-07-31 | The Academy LMS WordPress plugin through 3.8.2 does not restrict access to quiz attempt records to their owner, allowing any authenticated user with subscriber… |
CVE-2026-68501 | Medium | 6.5 | 2026-07-30 | Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank… |
CVE-2026-68500 | High | 7.5 | 2026-07-30 | Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/upda… |
CVE-2026-10700 | Medium | 6.5 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user fi… |
CVE-2026-12945 | High | 7.1 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrie… |
CVE-2026-15658 | High | 8.1 | 2026-07-30 | A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users… |
CVE-2026-67348 | High | 8.1 | 2026-07-30 | Julep contains an insecure direct object reference vulnerability in the get_execution_details endpoint that allows authenticated tenants to read another tenant… |
CVE-2026-15257 | Medium | 5.3 | 2026-07-30 | The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allo… |
CVE-2026-15255 | Medium | 5.3 | 2026-07-30 | The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being… |
CVE-2026-14310 | Medium | 5.4 | 2026-07-30 | The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing… |
CVE-2026-14223 | Medium | 4.3 | 2026-07-30 | The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subsc… |
CVE-2026-13345 | Medium | 5.3 | 2026-07-30 | The Essential Addons for Elementor WordPress plugin before 6.6.10 does not perform authorization, status, or visibility checks when resolving WooCommerce prod… |
CVE-2026-13178 | High | 7.5 | 2026-07-30 | The Eventin WordPress plugin before 4.1.16 does not properly authorize order creation and accepts an attacker-supplied order status, allowing unauthenticated… |
CVE-2026-13145 | Medium | 4.3 | 2026-07-30 | The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowin… |
CVE-2025-60931 | High | 7.5 | 2026-07-29 | An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbit… |
CVE-2026-5060 | Medium | 6.5 | 2026-07-29 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2026-63242 | Medium | 4.3 | 2026-07-29 | A business logic vulnerability in Koollab LMS allowed an authenticated learner to set their lesson completion status to completed via the SCORM commit endpoint… |
CVE-2026-63241 | Low | 3.1 | 2026-07-29 | An insecure direct object reference vulnerability in Koollab LMS allowed an authenticated user to query the course completion progress of any other user withou… |
CVE-2026-14224 | Medium | 5.4 | 2026-07-29 | The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current u… |
CVE-2026-57510 | High | 8.8 | 2026-07-28 | SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with vie… |
CVE-2026-49258 | High | 8.8 | 2026-07-28 | Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA sc… |
CVE-2026-18028 | | 2026-07-28 | The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This vi… | |
CVE-2026-16797 | Medium | 4.3 | 2026-07-28 | The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version… |
CVE-2026-59240 | | 2026-07-27 | The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/del… | |
CVE-2026-48052 | Medium | 5.4 | 2026-07-27 | Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can dele… |
CVE-2026-17570 | Medium | 4.3 | 2026-07-27 | Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credentia… |
CVE-2026-17531 | Medium | 5.0 | 2026-07-27 | A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts… |
CVE-2026-59546 | High | 7.4 | 2026-07-27 | Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions. |