CWE-639 · Authorization Bypass Through User-Controlled Key (page 2)
Page 2 of 29 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-97646 | High | 7.3 | 2026-09-25 | A weakness has been identified in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This affects an unknown function of the… |
CVE-2026-97636 | Medium | 6.5 | 2026-09-24 | Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deploymen… |
CVE-2026-97368 | Medium | 6.3 | 2026-09-24 | A weakness has been identified in chillzhuang SpringBlade up to 5.0.2. This affects the function UserServiceImpl.userInfo of the file blade-service/blade-syste… |
CVE-2026-77293 | High | 7.1 | 2026-09-24 | TREK is a collaborative travel planner. Prior to 3.3.0, the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint authorizes an authenticated u… |
CVE-2026-52850 | Medium | 4.3 | 2026-09-24 | Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong to a private space… |
CVE-2026-48073 | Medium | 4.3 | 2026-09-24 | Docmost is open-source collaborative wiki and documentation software. From 0.70.0 until 0.80.1, a low-privileged authenticated user who can edit an exportable… |
CVE-2026-79759 | Medium | 4.3 | 2026-09-24 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the POST /credentials/:id… |
CVE-2026-79758 | Medium | 5.4 | 2026-09-24 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix user… |
CVE-2026-76907 | Medium | 6.5 | 2026-09-24 | LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts sequential seven-d… |
CVE-2026-78310 | Medium | 4.3 | 2026-09-24 | Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. |
CVE-2026-87739 | | 2026-09-24 | An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report genera… | |
CVE-2026-93661 | Low | 2.7 | 2026-09-24 | The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against… |
CVE-2026-89004 | Low | 2.7 | 2026-09-24 | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored configuration and… |
CVE-2026-82849 | Medium | 4.3 | 2026-09-24 | The Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned, allowing any… |
CVE-2026-96762 | High | 7.3 | 2026-09-24 | A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. Th… |
CVE-2026-84720 | Medium | 6.5 | 2026-09-23 | A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged… |
CVE-2026-84713 | Medium | 6.5 | 2026-09-23 | A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification_ configura… |
CVE-2026-95602 | Medium | 6.5 | 2026-09-23 | Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-95592 | Medium | 5.3 | 2026-09-23 | Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions. |
CVE-2026-93623 | Medium | 5.3 | 2026-09-23 | Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions. |
CVE-2026-93513 | Medium | 4.3 | 2026-09-23 | Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions. |
CVE-2026-90899 | | 2026-09-23 | Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser… | |
CVE-2026-76089 | High | 7.7 | 2026-09-23 | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action i… |
CVE-2026-76087 | High | 8.2 | 2026-09-23 | Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::acti… |
CVE-2026-86938 | High | 7.3 | 2026-09-23 | A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated administrator privileges… |
CVE-2026-86934 | Critical | 9.1 | 2026-09-23 | An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disa… |
CVE-2026-86867 | Medium | 6.5 | 2026-09-23 | Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and i… |
CVE-2026-92419 | | 2026-09-23 | WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in the Gantt vacation c… | |
CVE-2026-55610 | High | 8.7 | 2026-09-23 | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in… |
CVE-2026-86678 | High | 8.8 | 2026-09-23 | ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform a… |
CVE-2026-84791 | High | 7.1 | 2026-09-23 | ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an auth… |
CVE-2026-84789 | High | 7.1 | 2026-09-23 | ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an auth… |
CVE-2026-91025 | Medium | 4.3 | 2026-09-23 | The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific… |
CVE-2026-84150 | Medium | 5.4 | 2026-09-23 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not verify that the target user of a REST route ma… |
CVE-2026-81339 | Medium | 4.3 | 2026-09-23 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform a per-object ownership check when returning a quiz attempt result, allowi… |
CVE-2026-80342 | Medium | 6.5 | 2026-09-23 | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooC… |
CVE-2026-77766 | Medium | 4.3 | 2026-09-23 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to… |
CVE-2026-16264 | Medium | 6.5 | 2026-09-23 | The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management sessio… |
CVE-2026-96271 | High | 7.1 | 2026-09-23 | Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to create share links… |
CVE-2026-77426 | | 2026-09-22 | Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segme… | |
CVE-2026-77425 | Medium | 4.3 | 2026-09-22 | Unleash is an open-source feature management platform. Prior to 8.0.3, POST /api/admin/projects/:projectId/features/:featureName/environments/:environment/stra… |
CVE-2026-76910 | | 2026-09-22 | Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:featureName/clone a… | |
CVE-2026-75101 | Medium | 6.5 | 2026-09-22 | An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed any authenticated user of the instance to read the raw diff or pa… |
CVE-2026-83805 | Medium | 6.4 | 2026-09-22 | Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic ApprovalWorkflowStageResponse create endpoint does n… |
CVE-2026-94462 | High | 7.1 | 2026-09-22 | Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api… |
CVE-2026-95655 | High | 8.1 | 2026-09-22 | Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attack… |
CVE-2026-75517 | Medium | 6.5 | 2026-09-22 | Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu integration mutation use cases including remove-integration, up… |
CVE-2026-95683 | | 2026-09-22 | In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using onl… | |
CVE-2026-93556 | | 2026-09-22 | The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed. The JWT token for t… | |
CVE-2026-18439 | Medium | 4.3 | 2026-09-22 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4… |
CVE-2026-12995 | Medium | 4.3 | 2026-09-22 | The Custom Field Template plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.7.8 via the edit_meta_… |
CVE-2026-94536 | Medium | 4.3 | 2026-09-21 | lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users to read any employe… |
CVE-2026-94535 | High | 7.1 | 2026-09-21 | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to delete other users'… |
CVE-2026-94534 | High | 7.1 | 2026-09-21 | lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated attackers to modify… |
CVE-2026-94533 | Medium | 6.5 | 2026-09-21 | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download arbitrary attachme… |
CVE-2026-94532 | Medium | 6.5 | 2026-09-21 | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the getUserInfoById endpoint that allows authenticated users to read any other user… |
CVE-2026-79917 | Medium | 6.5 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{chat_id}/share_chat verifies that a con… |
CVE-2026-77523 | High | 7.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path workspace but ModelS… |
CVE-2026-77517 | Medium | 5.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id i… |
CVE-2026-77516 | Medium | 5.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserR… |
CVE-2026-55179 | Medium | 6.5 | 2026-09-21 | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/conten… |
CVE-2026-94497 | High | 8.3 | 2026-09-21 | jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authenticated users can read… |
CVE-2026-94494 | Medium | 5.0 | 2026-09-21 | jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info end… |
CVE-2026-61748 | Medium | 4.3 | 2026-09-21 | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/… |
CVE-2026-61747 | Medium | 4.3 | 2026-09-21 | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the /api/importer/row/ and /api/importer/mapping/ endpoints do not scope DataImportRow… |
CVE-2026-61744 | Medium | 6.5 | 2026-09-21 | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON barcode containing a… |
CVE-2026-69190 | Medium | 6.3 | 2026-09-21 | Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a… |
CVE-2026-48976 | High | 8.1 | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.go updates a notifi… |
CVE-2026-48975 | High | 8.1 | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delete in backend/intern… |
CVE-2026-48826 | High | 8.1 | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1_ctrl_actions.go authorizes POST /v1… |
CVE-2026-88978 | Medium | 4.3 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pk… |
CVE-2026-84298 | Low | 3.1 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores… |
CVE-2026-55625 | Medium | 4.9 | 2026-09-21 | GoCD is a continuous deliver server. From 16.1.0 until 26.1.0, the internal material connection test APIs at /go/api/admin/internal/material_test and /go/api/i… |
CVE-2026-52743 | Medium | 4.3 | 2026-09-21 | GoCD is a continuous deliver server. Prior to 26.1.0, the internal GoCD UI /jobStatus.json API does not validate that a requested server-assigned job ID belong… |
CVE-2026-94393 | | 2026-09-21 | When a user creates or edits a report inside an event, MISP can identify an existing report using its UUID without properly checking whether that report actual… | |
CVE-2026-94382 | Medium | 4.2 | 2026-09-21 | Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that allows any authent… |
CVE-2025-71420 | Medium | 4.3 | 2026-09-21 | UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replie… |
CVE-2026-94374 | | 2026-09-21 | MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the… | |
CVE-2026-94152 | Medium | 4.3 | 2026-09-21 | A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the compone… |
CVE-2026-81654 | Low | 3.1 | 2026-09-20 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving image sizing set… |
CVE-2026-81653 | Medium | 4.2 | 2026-09-20 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allow… |
CVE-2026-81652 | Low | 2.7 | 2026-09-20 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the requesting user is entitled to a given image record before re… |
CVE-2026-81651 | Low | 3.1 | 2026-09-20 | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user saving a gallery owns it, allowing any user granted its… |
CVE-2026-93991 | High | 7.7 | 2026-09-19 | Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply cluster-scoped access re… |
CVE-2026-93955 | Medium | 4.3 | 2026-09-19 | A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file back… |
CVE-2026-92425 | Medium | 5.5 | 2026-09-19 | The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of it… |
CVE-2026-92421 | Medium | 4.7 | 2026-09-19 | The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.3 does not verify that the host record being modified belongs to the… |
CVE-2026-92420 | Low | 3.8 | 2026-09-19 | The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user befor… |
CVE-2026-91847 | Medium | 4.8 | 2026-09-19 | The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversatio… |
CVE-2026-89333 | Medium | 6.5 | 2026-09-19 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and includin… |
CVE-2026-76901 | Medium | 5.8 | 2026-09-18 | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in Poo… |
CVE-2026-63647 | | 2026-09-18 | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anon… | |
CVE-2026-81182 | Medium | 4.2 | 2026-09-18 | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can d… |
CVE-2026-77385 | Medium | 4.3 | 2026-09-18 | Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-… |
CVE-2026-63458 | | 2026-09-18 | Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one pr… | |
CVE-2026-62279 | High | 7.1 | 2026-09-18 | LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, an authenticated user could submit caller-con… |
CVE-2026-93758 | High | 8.1 | 2026-09-18 | An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges… |
CVE-2026-81505 | | 2026-09-18 | Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint authorizes access to the proj… | |
CVE-2026-77240 | Critical | 9.9 | 2026-09-18 | WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier, the profiles_update row-level security policy in supabase/migrations/017_acco… |
CVE-2026-93736 | Medium | 4.3 | 2026-09-18 | Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any user's recipe rating… |