CWE-639 · Authorization Bypass Through User-Controlled Key (page 4)
Page 4 of 29 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9225 | Medium | 6.5 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due to improper access… |
CVE-2026-68527 | | 2026-09-10 | Concrete CMS versions 8.3.0 through 9.5.2 are vulnerable to an authorization bypass in the Calendar event edit dialog (concrete/controllers/dialog/event/edit.p… | |
CVE-2026-88877 | Critical | 9.8 | 2026-09-10 | Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry… |
CVE-2026-88865 | High | 8.1 | 2026-09-10 | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authenticated users with… |
CVE-2026-80354 | High | 8.1 | 2026-09-10 | Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resolution allows a tena… |
CVE-2026-82582 | Medium | 4.3 | 2026-09-10 | An authorization bypass vulnerability exists in SHIRASAGI through a user-controlled key, which may allow an unauthorized attacker to retrieve files from the gr… |
CVE-2026-84062 | Medium | 4.3 | 2026-09-10 | BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited, the content of th… |
CVE-2026-87997 | Medium | 4.3 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/cha… |
CVE-2026-87994 | Medium | 4.3 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend… |
CVE-2026-79324 | High | 7.5 | 2026-09-09 | Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated atta… |
CVE-2026-47156 | | 2026-09-09 | MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_login() function. Any… | |
CVE-2026-67403 | | 2026-09-09 | Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated… | |
CVE-2026-86763 | Low | 3.5 | 2026-09-09 | Snipe-IT versions >= 7.0.12 and <= 8.6.3 contain an authorization bypass in the Livewire importer component (App\Livewire\Importer, mounted at the imports.inde… |
CVE-2026-86761 | Medium | 4.3 | 2026-09-09 | snipe-it versions before 8.7.0 contain an authorization bypass vulnerability in location print endpoints that fails to enforce per-model authorization checks… |
CVE-2026-86743 | Medium | 5.0 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users to read pending acc… |
CVE-2026-87809 | Medium | 6.5 | 2026-09-09 | Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/copyStdMarkdown endpo… |
CVE-2026-85037 | Medium | 5.3 | 2026-09-09 | The Sunshine Photo Cart WordPress plugin before 3.7 does not validate that a client-supplied price identifier belongs to the item being purchased when it is a… |
CVE-2026-13146 | Low | 3.7 | 2026-09-09 | The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowi… |
CVE-2026-87047 | Medium | 6.3 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87033 | Medium | 5.4 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87025 | Medium | 5.4 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87019 | Medium | 4.3 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-53639 | | 2026-09-08 | Sylius is an Open Source eCommerce Framework on Symfony. Starting in version 2.0.0 and prior to version 2.0.18, 2.1.15, and 2.2.6, the `GET /api/v2/shop/paymen… | |
CVE-2026-19651 | High | 7.4 | 2026-09-08 | IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query par… |
CVE-2026-78462 | High | 8.8 | 2026-09-08 | Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-69375 | Medium | 6.5 | 2026-09-08 | Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network. |
CVE-2026-86840 | Critical | 9.1 | 2026-09-08 | The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supp… |
CVE-2026-86725 | High | 7.1 | 2026-09-08 | AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's add.json.php endpoi… |
CVE-2026-86720 | High | 8.1 | 2026-09-08 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live_restreams_id in resendRestreamer.json.php, allowing aut… |
CVE-2026-73320 | Medium | 6.1 | 2026-09-08 | XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private unfurl records… |
CVE-2026-81802 | Medium | 6.5 | 2026-09-08 | Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions. |
CVE-2026-86489 | Medium | 6.5 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18634 an IDOR in the user profile API disclosed private issues and starred folders across organizations |
CVE-2026-86488 | Medium | 6.5 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches |
CVE-2026-86481 | Medium | 4.3 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons |
CVE-2026-86451 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first che… |
CVE-2026-86408 | Medium | 6.5 | 2026-09-07 | Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view(). The vulnerable… |
CVE-2026-4945 | Medium | 5.3 | 2026-09-07 | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all vers… |
CVE-2026-86277 | High | 7.3 | 2026-09-07 | A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. Impacted is an unknown function of the file del… |
CVE-2026-86263 | High | 7.3 | 2026-09-07 | A vulnerability was detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder o… |
CVE-2026-86262 | High | 7.3 | 2026-09-07 | A security vulnerability has been detected in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects the function updateOrderSta1/upd… |
CVE-2026-86261 | High | 7.3 | 2026-09-07 | A weakness has been identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The impacted element is an unknown function of the file s… |
CVE-2026-86183 | Medium | 5.3 | 2026-09-06 | A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmW… |
CVE-2026-16310 | Critical | 9.8 | 2026-09-06 | The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to… |
CVE-2026-86192 | Medium | 6.5 | 2026-09-05 | SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hid… |
CVE-2026-86191 | Medium | 4.3 | 2026-09-05 | SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate… |
CVE-2026-86176 | Medium | 4.3 | 2026-09-05 | NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authentica… |
CVE-2026-86174 | Medium | 4.3 | 2026-09-05 | Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comment… |
CVE-2026-86113 | Medium | 6.5 | 2026-09-05 | BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' r… |
CVE-2026-86112 | Medium | 5.4 | 2026-09-05 | BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfa… |
CVE-2026-86111 | Medium | 6.5 | 2026-09-05 | BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read followers-only and d… |
CVE-2026-84225 | Low | 2.2 | 2026-09-05 | The Kirki WordPress plugin before 6.3.0 does not check that a user is allowed to act on a collaboration comment before changing its state, allowing users whom… |
CVE-2026-81424 | Medium | 5.3 | 2026-09-05 | The Accept Stripe Payments WordPress plugin before 2.1.4 does not verify that the product fulfilled when a checkout is completed matches the product the author… |
CVE-2026-78150 | Low | 2.7 | 2026-09-05 | The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributo… |
CVE-2026-85638 | High | 7.3 | 2026-09-04 | A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes auth… |
CVE-2026-61688 | Medium | 6.5 | 2026-09-04 | SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API token… |
CVE-2026-17627 | Medium | 4.9 | 2026-09-04 | IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due… |
CVE-2026-85693 | Medium | 6.5 | 2026-09-04 | Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belongin… |
CVE-2026-85624 | Medium | 6.5 | 2026-09-04 | Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verification on supplied… |
CVE-2026-85607 | High | 8.8 | 2026-09-04 | Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.update, message.delete, message.clearAfte… |
CVE-2026-85617 | High | 8.8 | 2026-09-04 | snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users to soft-delete users… |
CVE-2026-85616 | High | 8.5 | 2026-09-04 | Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enable… |
CVE-2026-85615 | Medium | 6.4 | 2026-09-04 | Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to… |
CVE-2026-85611 | Medium | 6.4 | 2026-09-04 | OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures… |
CVE-2026-85594 | Critical | 9.8 | 2026-09-04 | Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares Service annotation i… |
CVE-2026-85579 | Medium | 4.3 | 2026-09-04 | SiYuan is affected by an information disclosure vulnerability (confirmed in v3.8.1, fixed in v3.8.2) in the reader-accessible POST /api/transactions/undoState… |
CVE-2026-27432 | Medium | 5.4 | 2026-09-04 | Authorization Bypass Through User-Controlled Key vulnerability in sc Internet Vivoo WP Rentals allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-79630 | Medium | 5.3 | 2026-09-04 | The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was… |
CVE-2026-16281 | High | 7.1 | 2026-09-04 | The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX acti… |
CVE-2026-85381 | Medium | 5.3 | 2026-09-04 | A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affec… |
CVE-2026-85378 | High | 7.3 | 2026-09-03 | A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is th… |
CVE-2026-83711 | Critical | 10.0 | 2026-09-03 | Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-69857 | High | 8.5 | 2026-09-03 | Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network. |
CVE-2026-85392 | Medium | 4.3 | 2026-09-03 | Peppermint through 0.5.5 contains an authorization bypass vulnerability in the GET /api/v1/auth/user/:id/logout endpoint that allows authenticated attackers to… |
CVE-2026-85389 | Medium | 6.5 | 2026-09-03 | Worklenz before 3.0.0 fails to verify task ownership by organization when resolving task-scoped API endpoints, allowing authenticated users to access another t… |
CVE-2026-85308 | Medium | 5.3 | 2026-09-03 | Authorization Bypass Through User-Controlled Key vulnerability in Brainstorm Force SureForms allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-84836 | High | 7.1 | 2026-09-03 | Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions. |
CVE-2026-84769 | Medium | 6.5 | 2026-09-03 | Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions. |
CVE-2026-75035 | High | 7.7 | 2026-09-03 | A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropp… |
CVE-2026-85214 | High | 8.1 | 2026-09-03 | vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by supplying any profile ID… |
CVE-2026-85211 | High | 7.7 | 2026-09-03 | Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenan… |
CVE-2026-85182 | High | 7.5 | 2026-09-03 | vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated attackers can change… |
CVE-2026-85178 | High | 7.7 | 2026-09-03 | Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requester's organization… |
CVE-2026-85177 | Medium | 5.4 | 2026-09-03 | CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbi… |
CVE-2026-75033 | High | 7.7 | 2026-09-03 | A flaw was found in Rancher Manager. Project Secrets were propagated into a namespace based only on its `field.cattle.io/projectId` annotation, without verifyi… |
CVE-2026-71404 | High | 8.7 | 2026-09-03 | A flaw was found in Rancher Manager. The GlobalRole controller derived the target ClusterRole name from the user-settable `authz.management.cattle.io/cr-name`… |
CVE-2026-71403 | Medium | 6.1 | 2026-09-03 | A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user h… |
CVE-2026-85173 | Medium | 4.3 | 2026-09-03 | n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights s… |
CVE-2026-85105 | High | 7.3 | 2026-09-03 | A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the component Session Mana… |
CVE-2026-80254 | Medium | 6.5 | 2026-09-03 | Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who can log in to the product may change the… |
CVE-2026-78065 | | 2026-09-03 | Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `ed… | |
CVE-2026-78064 | | 2026-09-03 | Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `fof.xml… | |
CVE-2026-84672 | High | 8.8 | 2026-09-02 | Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID a… |
CVE-2026-79990 | | 2026-09-02 | Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments()… | |
CVE-2026-14326 | Low | 3.8 | 2026-09-02 | The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its cus… |
CVE-2026-84796 | High | 8.8 | 2026-09-02 | Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId through ArgumentMa… |
CVE-2026-84771 | Medium | 5.3 | 2026-09-02 | Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions. |
CVE-2026-81428 | Medium | 6.5 | 2026-09-02 | The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing auth… |
CVE-2026-81198 | Low | 3.8 | 2026-09-02 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of a curriculum object before acting on it, allowing au… |
CVE-2026-81196 | Low | 2.7 | 2026-09-02 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instr… |
CVE-2026-81194 | Medium | 4.3 | 2026-09-02 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any… |