CWE-639 · Authorization Bypass Through User-Controlled Key (page 5)
Page 5 of 23 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-10096 | Medium | 4.3 | 2026-07-01 | The Qi Blocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.4.9 via the 'page_id' parameter du… |
CVE-2026-12904 | Medium | 4.3 | 2026-07-01 | The Kadence Blocks – Gutenberg Blocks for Page Builder Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and in… |
CVE-2026-11988 | Medium | 6.5 | 2026-07-01 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2026-56230 | High | 8.8 | 2026-06-30 | Capgo before 12.128.2 contains a broken object level authorization vulnerability in middlewareKey() that accepts the client-controlled x-limited-key-id header… |
CVE-2026-58447 | Medium | 6.5 | 2026-06-30 | Invidious through 2.20260626.0, fixed in commit 77ad416, contains a broken object level authorization vulnerability that allows authenticated attackers to dele… |
CVE-2026-10140 | Critical | 9.6 | 2026-06-30 | IBM Langflow OSS 1.0.0 through 1.10.0 voice mode contains improper shared-state handling that allows reuse of API clients across tenant boundaries. An authenti… |
CVE-2026-27956 | Medium | 4.3 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/servers/{server_uuid}… |
CVE-2026-27883 | Medium | 5.0 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, the `GET /api/v1/deployments/{uuid… |
CVE-2026-27881 | Medium | 5.0 | 2026-06-30 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.464, `GET /api/v1/deployments/{uuid}` i… |
CVE-2026-14209 | Medium | 4.3 | 2026-06-30 | A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Adm… |
CVE-2026-12073 | Critical | 9.8 | 2026-06-30 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to… |
CVE-2026-34592 | High | 7.7 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, Coolify server and project lookups… |
CVE-2026-57498 | Critical | 9.6 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consiste… |
CVE-2026-57956 | Medium | 6.4 | 2026-06-29 | SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a… |
CVE-2026-57945 | Medium | 4.3 | 2026-06-29 | PhotoPrism before 260601-a7d098548 contains a broken access control vulnerability that allows authenticated non-admin users to modify other users' profile info… |
CVE-2026-57943 | Medium | 5.9 | 2026-06-29 | LibrePhotos before 1.0.0 contains a broken object level authorization vulnerability in the SetPhotosShared endpoint that allows authenticated users to grant th… |
CVE-2026-56781 | Medium | 5.3 | 2026-06-29 | Teable before 2026-06-15T04-43-24Z.1912 contains an improper access control vulnerability that allows anonymous attackers to access hidden field data by supply… |
CVE-2026-56780 | High | 7.5 | 2026-06-29 | Modoboa before 2.9.0 contains an insecure direct object reference vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint that allows domain administ… |
CVE-2026-57341 | Medium | 6.5 | 2026-06-29 | Unauthenticated Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 versions. |
CVE-2026-57676 | Medium | 4.3 | 2026-06-29 | Authorization Bypass Through User-Controlled Key vulnerability in Matteo Manna Simple User Avatar allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2026-13549 | Medium | 5.4 | 2026-06-29 | A security flaw has been discovered in CodeAstro Complaint Management System 1.0. The affected element is the function deletereport of the file application/con… |
CVE-2026-13534 | Medium | 5.0 | 2026-06-29 | A vulnerability was detected in CherryHQ cherry-studio up to 1.9.7. This affects the function sha256 of the file src/main/services/memory/MemoryService.ts of t… |
CVE-2026-13512 | Medium | 6.3 | 2026-06-28 | A vulnerability was identified in Databend up to 1.2.881 on HTTP. This affects the function ClientSessionManager::state_key of the file src/query/service/src/s… |
CVE-2026-13490 | Low | 3.7 | 2026-06-28 | A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/documen… |
CVE-2026-11987 | Medium | 4.3 | 2026-06-27 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Ob… |
CVE-2026-52782 | Critical | 9.9 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects/<A>/settings/project_storages… |
CVE-2026-52779 | Medium | 5.4 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cross-project IDOR / authorization context confusion in the Ca… |
CVE-2026-49355 | Medium | 4.3 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.4.0, `GET /api/v3/meetings/:meeting_id/agenda_items/:agenda_item_id` discloses p… |
CVE-2026-44736 | Medium | 6.5 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retriev… |
CVE-2026-44732 | Medium | 4.3 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, OpenProject exposes a document update endpoint used to modify ex… |
CVE-2026-44731 | Medium | 4.3 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the web application's meetings filter feature leaks whether a gi… |
CVE-2026-56823 | Medium | 5.4 | 2026-06-26 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to , the `POST /api/integratio… |
CVE-2026-12411 | High | 8.4 | 2026-06-26 | Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's cust… |
CVE-2026-57665 | Medium | 5.3 | 2026-06-26 | Unauthenticated Insecure Direct Object References (IDOR) in GravityView <= 3.0.0 versions. |
CVE-2026-57652 | Medium | 5.3 | 2026-06-26 | Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions. |
CVE-2026-57646 | Medium | 5.4 | 2026-06-26 | Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions. |
CVE-2026-57634 | Medium | 4.3 | 2026-06-26 | Contributor Insecure Direct Object References (IDOR) in PPWP <= 1.9.19 versions. |
CVE-2026-57630 | Medium | 5.3 | 2026-06-26 | Unauthenticated Insecure Direct Object References (IDOR) in Blocksy Companion Pro <= 2.1.46 versions. |
CVE-2026-56069 | High | 7.5 | 2026-06-26 | Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions. |
CVE-2026-56048 | Medium | 6.5 | 2026-06-26 | Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions. |
CVE-2026-54839 | High | 7.5 | 2026-06-26 | Unauthenticated Sensitive Data Exposure in Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 versions. |
CVE-2026-54826 | High | 7.6 | 2026-06-26 | Subscriber Insecure Direct Object References (IDOR) in SupportCandy <= 3.4.6 versions. |
CVE-2025-66123 | Medium | 5.3 | 2026-06-26 | Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= 1.1.0 versions. |
CVE-2026-56774 | Medium | 5.4 | 2026-06-25 | Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeS… |
CVE-2026-56772 | Medium | 4.3 | 2026-06-25 | NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary… |
CVE-2026-54097 | | 2026-06-25 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, a low… | |
CVE-2026-9799 | Medium | 4.6 | 2026-06-25 | A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit t… |
CVE-2026-9099 | High | 7.7 | 2026-06-25 | A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an authenticated user wit… |
CVE-2026-55411 | Medium | 6.8 | 2026-06-25 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.1780-lts, the aut… |
CVE-2026-13350 | | 2026-06-25 | Permissions where checked incorrectly during room creation, allowing attackers to create rooms of types they shouldn't be allowed to create. | |
CVE-2026-56013 | Medium | 6.5 | 2026-06-25 | Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions. |
CVE-2026-5309 | Medium | 5.4 | 2026-06-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain cond… |
CVE-2026-52812 | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git LFS storage is content-addressed by OID alone (<LFS-root>/<oid[0]>/<oid[1]>/<oid>) but per… | |
CVE-2026-52799 | High | 7.5 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, GET /attachments/:uuid returns the raw attachment file without verifying whether the requester… |
CVE-2026-55583 | High | 7.6 | 2026-06-24 | Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.9.0, Twenty was vulnerable to a cross-workspace insecure direct object ref… |
CVE-2026-27708 | | 2026-06-24 | FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, the Servicecustom Client API's __call method accepts an o… | |
CVE-2026-55611 | Unrated | | 2026-06-24 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. From 1.11.1 until 1.14.1, userId/wo… |
CVE-2026-47388 | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, a low-privilege MCP token holder with knowledge of an attachment path could read… | |
CVE-2026-47378 | | 2026-06-23 | NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, Public shared-view endpoints exposed values from columns that the view owner had… | |
CVE-2025-64105 | | 2026-06-23 | FOSSBilling is a billing and client management system that automates invoicing, payments, and communication for online service businesses. Versions 0.6.21 thro… | |
CVE-2026-54322 | High | 7.7 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role updat… |
CVE-2026-54324 | Medium | 6.5 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, a cross-tenant authorization flaw… |
CVE-2026-54016 | Medium | 4.3 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI has a Broken Object Level Authori… |
CVE-2026-54015 | Medium | 6.4 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI's prompt version-history endpoint… |
CVE-2026-54010 | High | 8.3 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated user attach… |
CVE-2026-54009 | Medium | 6.5 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST /api/chat/completions accepts an image_… |
CVE-2026-54006 | Medium | 4.3 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST /api/v1/calendars/events/{event_id}/upd… |
CVE-2026-55255 | High | 8.4 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api… |
CVE-2026-45732 | High | 8.1 | 2026-06-23 | n8n is an open source workflow automation platform. Prior to 1.123.43, 2.22.1, and 2.20.7, the OAuth1 and OAuth2 credential reconnect endpoints authorized acce… |
CVE-2026-33760 | High | 8.8 | 2026-06-23 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.0, Langflow's /api/v1/monitor router exposes 7 endpoints that perfo… |
CVE-2025-62180 | | 2026-06-23 | Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional… | |
CVE-2026-56784 | High | 8.1 | 2026-06-23 | OpenRemote before 1.25.0 contains an insecure direct object reference (IDOR) vulnerability in the bulk alarm deletion endpoint that allows authenticated users… |
CVE-2026-56222 | High | 7.2 | 2026-06-23 | Capgo before 12.128.2 contains an authorization bypass vulnerability in POST /private/role_bindings that fails to verify app_id ownership during app-scoped rol… |
CVE-2026-48067 | Medium | 6.5 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From filament/actions 4.0.0 until 4.11.4 and 5.6.4 and from filament/tab… |
CVE-2026-6062 | Medium | 6.4 | 2026-06-22 | Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 Fail to validate channel ownership of an existing subscription be… |
CVE-2026-56424 | High | 8.8 | 2026-06-22 | MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability che… |
CVE-2026-56422 | | 2026-06-22 | Multiple MISP core controllers and model capture paths accepted client-controlled request fields such as primary keys (id) and ownership/scope foreign keys (ev… | |
CVE-2026-56385 | Medium | 4.3 | 2026-06-21 | Craft CMS versions >= 5.0.0-RC1, <= 5.9.13 and >= 4.0.0-RC1, <= 4.17.7 contain an authorization bypass in the assets/preview-file endpoint. The action does not… |
CVE-2026-56229 | Medium | 6.5 | 2026-06-21 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the /build/status and /build/logs endpoints that allows attackers to access build jobs… |
CVE-2026-56215 | High | 8.3 | 2026-06-20 | Capgo before 12.128.12 allows authenticated users to modify their mutable public.users.email to arbitrary addresses, which the SSO provisioning endpoint trusts… |
CVE-2026-49339 | High | 7.1 | 2026-06-19 | gonic is a music streaming server / free-software subsonic server API implementation. The maintainer's fix in commit `6dd71e6a3c966867ef8c900d359a7df75789f410… |
CVE-2026-49338 | High | 7.1 | 2026-06-19 | gonic is a music streaming server / free-software subsonic server API implementation. Prior to version 0.21.0, the Subsonic API endpoints `/rest/deletePlaylist… |
CVE-2026-54105 | Medium | 5.3 | 2026-06-18 | The U.S. Government Accountability Office (GAO) Electronic Protest Docketing System (EPDS) and Civilian Board of Contract Appeals (CBCA) Electronic Docketing S… |
CVE-2026-50141 | | 2026-06-18 | Woodpecker is a CI/CD engine. Starting in version 3.0.0 and prior to version 3.14.1, a vulnerability in Woodpecker CI's gRPC layer allowed any authenticated ag… | |
CVE-2026-12102 | Low | 2.7 | 2026-06-18 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Insecure Direct Obj… |
CVE-2026-10623 | Medium | 4.3 | 2026-06-18 | The PressPrimer Quiz – AI Quiz Maker, Exam Builder & LMS Assessment Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versio… |
CVE-2026-10023 | Medium | 4.3 | 2026-06-18 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Ob… |
CVE-2026-48759 | High | 7.1 | 2026-06-17 | TypeBot is a chatbot builder tool. Versions 3.15.2 and below have an Insecure Direct Object Reference vulnerability through cross-workspace Theme Template modi… |
CVE-2026-50194 | High | 8.2 | 2026-06-17 | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. When Steeltoe management endpoints… |
CVE-2026-55198 | Medium | 6.5 | 2026-06-17 | Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions f… |
CVE-2026-55197 | Medium | 6.5 | 2026-06-17 | Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-prof… |
CVE-2025-15657 | Medium | 5.3 | 2026-06-17 | Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions. |
CVE-2026-54184 | High | 8.2 | 2026-06-17 | Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions. |
CVE-2026-48783 | Medium | 4.8 | 2026-06-17 | Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscript… |
CVE-2026-40768 | High | 7.3 | 2026-06-17 | Unauthenticated Insecure Direct Object References (IDOR) in Salon booking system <= 10.30.24 versions. |
CVE-2026-53863 | High | 7.1 | 2026-06-16 | OpenClaw before 2026.4.25 contains an input validation vulnerability in tool group policy callers that accept unvalidated group IDs. Attackers who can supply a… |
CVE-2026-10780 | Medium | 4.3 | 2026-06-16 | The Static Block plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2. This is due to the static_bl… |
CVE-2026-48599 | | 2026-06-15 | Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to ot… | |
CVE-2026-52699 | High | 7.5 | 2026-06-15 | Unauthenticated Insecure Direct Object References (IDOR) in VikRentCar <= 1.4.5 versions. |
CVE-2026-48872 | High | 7.5 | 2026-06-15 | Unauthenticated Sensitive Data Exposure in EmbedPress <= 4.5.2 versions. |