CWE-639 · Authorization Bypass Through User-Controlled Key (page 3)
Page 3 of 29 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93660 | Medium | 6.5 | 2026-09-18 | SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace members to modify ot… |
CVE-2026-13471 | Medium | 4.3 | 2026-09-18 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up t… |
CVE-2026-12384 | High | 8.8 | 2026-09-18 | Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHIN2B Application allows Privilege Abuse. This issue affects TECHIN2B Applicatio… |
CVE-2026-92714 | Medium | 6.5 | 2026-09-18 | The Download Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.3.68 via the duplicate() functi… |
CVE-2026-88844 | Low | 2.7 | 2026-09-18 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-stu… |
CVE-2026-87966 | Medium | 5.3 | 2026-09-18 | The Easy Appointments WordPress plugin before 4.0.2.2 does not perform an ownership or authorization check on its unauthenticated appointment-reservation endpo… |
CVE-2026-85009 | Medium | 6.5 | 2026-09-18 | The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, al… |
CVE-2026-81340 | Low | 3.8 | 2026-09-18 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform per-object ownership or capability checks when updating orders through it… |
CVE-2026-68493 | Low | 3.1 | 2026-09-18 | After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of. |
CVE-2026-18441 | Medium | 4.3 | 2026-09-18 | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all… |
CVE-2026-69865 | Critical | 10.0 | 2026-09-17 | Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-54671 | High | 8.8 | 2026-09-17 | WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and veri… |
CVE-2026-54239 | High | 8.8 | 2026-09-17 | Faust.js is a headless WordPress toolkit. Prior to 1.8.11, the FaustWP WordPress plugin authenticates only the ciphertext in its token envelope and excludes th… |
CVE-2026-82685 | | 2026-09-17 | Authorization Bypass Through User-Controlled Key vulnerability in team-alembic AshAuthentication allows an authenticated attacker to overwrite and confirm anot… | |
CVE-2026-73999 | Medium | 5.4 | 2026-09-17 | Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions. |
CVE-2026-66575 | Medium | 5.3 | 2026-09-17 | Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions. |
CVE-2026-87829 | Medium | 4.3 | 2026-09-17 | The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before de… |
CVE-2026-91016 | Medium | 5.3 | 2026-09-17 | The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowin… |
CVE-2026-91008 | Low | 3.7 | 2026-09-17 | The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirma… |
CVE-2026-61596 | High | 7.1 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object autho… |
CVE-2026-61589 | Medium | 6.3 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mo… |
CVE-2026-92588 | Medium | 4.4 | 2026-09-16 | n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push f… |
CVE-2026-92577 | High | 7.5 | 2026-09-16 | In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns user-group-restric… |
CVE-2026-61592 | High | 7.4 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed… |
CVE-2026-92810 | Medium | 4.3 | 2026-09-16 | PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated customers to retriev… |
CVE-2026-92809 | Medium | 4.3 | 2026-09-16 | PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers c… |
CVE-2026-92773 | High | 7.1 | 2026-09-16 | Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organization. Attackers can c… |
CVE-2026-92765 | Medium | 6.5 | 2026-09-16 | ArcherySec through 2.0.6 fails to validate organization ownership in the WebScanVulnList endpoint, allowing authenticated users to read vulnerability findings… |
CVE-2026-92752 | High | 8.3 | 2026-09-16 | metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissi… |
CVE-2026-63506 | High | 8.8 | 2026-09-16 | Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID an… |
CVE-2026-20342 | High | 7.7 | 2026-09-16 | A vulnerability in a specific file download API of Cisco Secure FMC Software could allow an authenticated, remote attacker to download arbitrary files from an… |
CVE-2026-87113 | Medium | 6.3 | 2026-09-16 | Tanium addressed an improper access controls vulnerability in Threat Response. |
CVE-2026-92716 | Critical | 9.6 | 2026-09-16 | Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and re… |
CVE-2026-92605 | Medium | 6.5 | 2026-09-16 | IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence items. Attackers wi… |
CVE-2026-47094 | High | 8.8 | 2026-09-16 | SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to access and modify arbitrary employee r… |
CVE-2026-92603 | Medium | 6.5 | 2026-09-16 | ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete o… |
CVE-2026-92567 | Medium | 6.5 | 2026-09-16 | TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows authenticated user… |
CVE-2026-89031 | Medium | 5.4 | 2026-09-16 | Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to modify the scheduled post records of other users. The b2s_calendar_move_po… |
CVE-2026-84860 | High | 8.8 | 2026-09-16 | ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself disp… |
CVE-2026-92469 | High | 8.1 | 2026-09-16 | zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the file-center module DELETE /files/{id} endpoint that performs… |
CVE-2026-92468 | Medium | 6.5 | 2026-09-16 | zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authenticated attackers to… |
CVE-2026-89029 | Medium | 4.3 | 2026-09-16 | Adenion Blog2Social plugin for WordPress before 9.1.0 allows low-privileged users to enumerate WordPress user accounts. The b2s_get_select_mandant_user AJAX ha… |
CVE-2026-86465 | Medium | 6.5 | 2026-09-16 | Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-team deployment, a Dag… |
CVE-2026-88910 | Medium | 5.3 | 2026-09-16 | The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers to permanently dele… |
CVE-2026-82125 | Medium | 5.3 | 2026-09-16 | The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not correctly verify the ownership or the moderation status of a comment before ret… |
CVE-2026-89063 | High | 7.5 | 2026-09-16 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and… |
CVE-2026-88065 | High | 7.5 | 2026-09-15 | `tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Con… |
CVE-2026-18423 | High | 7.1 | 2026-09-15 | Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs . An auth… |
CVE-2026-79409 | Medium | 6.5 | 2026-09-15 | An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components. |
CVE-2026-54050 | Medium | 6.5 | 2026-09-15 | Sakai is a Collaboration and Learning Environment (CLE). From 23.0 until 23.5 and 25.3, the DELETE /api/users/{userId}/profile/image endpoint allows an authent… |
CVE-2026-91984 | Medium | 4.3 | 2026-09-15 | Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authenticated attackers can… |
CVE-2026-91933 | High | 7.1 | 2026-09-15 | Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to access tools from Chat… |
CVE-2026-55178 | High | 7.5 | 2026-09-15 | GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints a… |
CVE-2026-91993 | Medium | 4.3 | 2026-09-15 | Jpom through 2.11.12 fails to validate workspace ownership when resolving repositoryId on the /build/branch-list endpoint, allowing authenticated users to acce… |
CVE-2026-52826 | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/{id}/rate/{rate}, /en/admin/customer/{id}/rate/{r… | |
CVE-2026-52821 | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/{project} and /en/admin/project/create/{c… | |
CVE-2026-52820 | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.57.0, PATCH /api/timesheets/{id} and POST /api/timesheets accept a user-controlled project identi… | |
CVE-2026-46498 | | 2026-09-15 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, OAuthTokenStore reads caller-supplied token identifiers from the shared Core… | |
CVE-2026-91846 | | 2026-09-15 | Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access… | |
CVE-2026-89141 | Medium | 6.5 | 2026-09-15 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and… |
CVE-2026-90858 | High | 7.3 | 2026-09-15 | A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulnerability is the fun… |
CVE-2026-91773 | Medium | 4.3 | 2026-09-15 | Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories… |
CVE-2026-91770 | Medium | 6.5 | 2026-09-15 | IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR rec… |
CVE-2026-91144 | High | 7.5 | 2026-09-14 | ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can… |
CVE-2026-54180 | High | 7.6 | 2026-09-14 | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administratio… |
CVE-2026-54178 | High | 8.1 | 2026-09-14 | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administratio… |
CVE-2026-54529 | Medium | 5.3 | 2026-09-14 | SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attacker-controlled sortB… |
CVE-2026-82441 | Critical | 9.1 | 2026-09-14 | Description A submitted topology carries two lists of blobstore keys, `dependency_jars` and `dependency_artifacts`, which the client fills in after uploading… |
CVE-2026-9812 | Medium | 6.5 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate that a property field belongs to the specified r… |
CVE-2026-10542 | Medium | 5.0 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel action ownership which allows channel ma… |
CVE-2026-90697 | Medium | 4.3 | 2026-09-14 | A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the… |
CVE-2026-90598 | Medium | 6.3 | 2026-09-13 | A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. The impacted element is the function… |
CVE-2026-90521 | Medium | 6.3 | 2026-09-13 | A vulnerability was found in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. This issue affects some unknown processin… |
CVE-2026-90517 | Medium | 5.3 | 2026-09-13 | A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The… |
CVE-2026-88912 | Medium | 4.2 | 2026-09-13 | The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and… |
CVE-2026-90552 | Medium | 4.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the Playlists_schedules/list.json.php and Live/cale… |
CVE-2026-90542 | Medium | 5.4 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate that logged-in users can access live schedules before creating reminders… |
CVE-2026-90534 | Medium | 6.5 | 2026-09-12 | Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name endpoint is mounte… |
CVE-2026-87894 | Medium | 5.3 | 2026-09-12 | The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation detai… |
CVE-2026-84025 | Low | 2.2 | 2026-09-12 | The BEAR WordPress plugin before 1.2.2 does not perform ownership checks on several handlers that return product data by a user-supplied identifier, allowing… |
CVE-2026-82851 | Low | 2.7 | 2026-09-12 | The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing user… |
CVE-2026-77705 | High | 7.2 | 2026-09-12 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.10 does not verify that the user editing a customer or employee record is entitle… |
CVE-2026-54258 | Medium | 6.5 | 2026-09-11 | ZoneMinder is a free, open source closed-circuit television software application. Versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-pri… |
CVE-2026-49464 | High | 8.1 | 2026-09-11 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizatio… |
CVE-2026-81916 | Medium | 4.3 | 2026-09-11 | Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identi… |
CVE-2026-81915 | Medium | 5.3 | 2026-09-11 | Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and… |
CVE-2026-62140 | Medium | 5.3 | 2026-09-11 | Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions. |
CVE-2026-62134 | Medium | 4.3 | 2026-09-11 | Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions. |
CVE-2026-62113 | Medium | 4.3 | 2026-09-11 | Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions. |
CVE-2026-89264 | Medium | 4.3 | 2026-09-11 | MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to post comments attribu… |
CVE-2026-89262 | High | 7.5 | 2026-09-11 | MoguBlog through 6.2 contains an authorization bypass vulnerability in the comment deletion endpoint that performs ownership checks against request-body fields… |
CVE-2026-89257 | Medium | 5.4 | 2026-09-11 | AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the… |
CVE-2026-89252 | Medium | 6.5 | 2026-09-11 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated use… |
CVE-2026-82213 | Medium | 5.3 | 2026-09-11 | The Nexi XPay Build WordPress plugin from 7.6.1 to 7.6.2 does not verify that the saved payment token being requested belongs to the current user, allowing una… |
CVE-2026-86782 | Medium | 5.5 | 2026-09-11 | The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing users with the Contributor role and ab… |
CVE-2026-82305 | Medium | 5.3 | 2026-09-11 | The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated use… |
CVE-2026-14566 | Medium | 4.3 | 2026-09-11 | The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before updating WooCommerce order ite… |
CVE-2026-18121 | | 2026-09-11 | Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) because the frontend calendar lightbox endpoint (/ccm/calendar/view_event/{bID}/{o… | |
CVE-2026-81210 | High | 7.7 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns… |
CVE-2026-80434 | High | 7.4 | 2026-09-10 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to manipulate runtime caches and cause a denial of service due to an in… |