CWE-639 · Authorization Bypass Through User-Controlled Key (page 5)
Page 5 of 29 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-77788 | Medium | 4.9 | 2026-09-02 | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, a… |
CVE-2026-77785 | Low | 2.7 | 2026-09-02 | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request befo… |
CVE-2026-77784 | Low | 2.7 | 2026-09-02 | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing me… |
CVE-2026-77783 | Low | 3.7 | 2026-09-02 | The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauth… |
CVE-2026-77764 | Medium | 4.3 | 2026-09-02 | The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscrib… |
CVE-2026-15232 | Medium | 5.3 | 2026-09-02 | The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-supplied booking iden… |
CVE-2026-82968 | Medium | 6.4 | 2026-09-02 | A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider account to their loca… |
CVE-2026-81846 | Low | 3.5 | 2026-09-01 | An authorization bypass in the runZero Platform MCP service has been resolved in version 5.1.260826.0. This issue is an instance of CWE-639: Authorization Bypa… |
CVE-2026-84205 | Medium | 6.5 | 2026-09-01 | GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revis… |
CVE-2026-84148 | | 2026-09-01 | This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticated remote attacker c… | |
CVE-2026-83743 | Medium | 6.3 | 2026-09-01 | A weakness has been identified in invoiceninja Invoice Ninja up to 5.13.26. This affects an unknown part of the file /vedor/profile/ of the component Vendor Po… |
CVE-2026-82395 | | 2026-08-31 | Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its pe… | |
CVE-2026-81892 | High | 8.1 | 2026-08-31 | EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a si… |
CVE-2026-75460 | Medium | 6.5 | 2026-08-31 | XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role para… |
CVE-2026-75458 | High | 8.1 | 2026-08-31 | The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalatio vulnerability… |
CVE-2026-50198 | Medium | 4.3 | 2026-08-31 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.1, an authenticated user can edit their own inactive subscription a… |
CVE-2026-72001 | High | 8.1 | 2026-08-31 | Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an a… |
CVE-2026-53552 | Critical | 9.6 | 2026-08-31 | Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in… |
CVE-2026-82816 | Medium | 6.3 | 2026-08-31 | A vulnerability has been found in dibo-software diboot 3.8.0. Affected by this vulnerability is an unknown functionality of the file /api/ai-session/ of the co… |
CVE-2026-79750 | High | 7.7 | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… |
CVE-2026-78075 | | 2026-08-31 | Joomla Extension - joomshaper.com - Broken Object-Level Authorization in Blog Image Deletion in Helix Ultimate < 2.2.10 - `Blog::remove_image()` checked whethe… | |
CVE-2026-82874 | Critical | 9.9 | 2026-08-31 | ToolJet before v3.16.208 fails to validate that authenticated users belong to the organization specified in the organizationId path parameter of tooljet-db end… |
CVE-2026-82873 | Medium | 5.0 | 2026-08-31 | ToolJet through 3.0.0-ee-beta.2 contains authorization bypass vulnerabilities in the POST /api/v2/resources/export endpoint that allow authenticated users to d… |
CVE-2026-82872 | Critical | 9.1 | 2026-08-31 | ToolJet before v3.16.208 fails to validate that the path organizationId matches the authenticated user's workspace before performing ToolJet DB table operation… |
CVE-2026-82870 | Critical | 9.6 | 2026-08-31 | ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or d… |
CVE-2026-82869 | High | 7.7 | 2026-08-31 | ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authe… |
CVE-2026-53620 | Medium | 6.3 | 2026-08-31 | GROWI contains a vulnerability with an authorization bypass through user-controlled key in the bookmark folder APIs. If this vulnerability is exploited, an aut… |
CVE-2026-82621 | High | 7.3 | 2026-08-31 | A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doG… |
CVE-2026-82725 | | 2026-08-31 | Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_phoenix lets an attacker who controls filter form parameters filter across re… | |
CVE-2026-81853 | | 2026-08-31 | Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_admin turns a record-lookup URL into an equality oracle over sensitive attrib… | |
CVE-2026-82602 | Medium | 5.3 | 2026-08-31 | A security vulnerability has been detected in SeaCMS up to 13.6. This vulnerability affects unknown code of the file /ass.php. The manipulation leads to author… |
CVE-2026-82564 | | 2026-08-31 | Authorization Bypass Through User-Controlled Key vulnerability in ash-project ash_ai allows a caller of an identity-configured tool to update or destroy record… | |
CVE-2026-81200 | Low | 2.7 | 2026-08-29 | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instru… |
CVE-2026-80311 | Medium | 4.3 | 2026-08-29 | The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.5 does not verify that a subscription belongs to the customer bound to the requesting cust… |
CVE-2026-55867 | | 2026-08-28 | Graylog is a free and open log management platform. From 6.2.0 until 6.3.12, 7.0.7, and 7.1.2, the DELETE /users/{userId}/tokens/{idOrToken} endpoint implement… | |
CVE-2026-19294 | Medium | 6.4 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization. |
CVE-2026-18904 | High | 8.2 | 2026-08-28 | IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collisi… |
CVE-2026-82290 | Medium | 5.3 | 2026-08-28 | Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users'… |
CVE-2026-82284 | High | 8.1 | 2026-08-28 | Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, and POST /chat/{chat_id}/question/an… |
CVE-2026-82283 | High | 8.1 | 2026-08-28 | VoltAgent through 2.1.20 fails to validate conversation ownership in memory API handlers, allowing authenticated users to access other users' conversations. At… |
CVE-2026-82281 | High | 7.4 | 2026-08-28 | Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in… |
CVE-2026-82280 | High | 7.1 | 2026-08-28 | Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-onl… |
CVE-2026-82271 | Medium | 6.5 | 2026-08-28 | R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' co… |
CVE-2026-55067 | Medium | 5.0 | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket} allows the reques… |
CVE-2026-55066 | High | 7.1 | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a b… |
CVE-2026-55065 | High | 8.1 | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. From 0.24.6 until 2.4.0, DELETE /api/v1/projects/:project/views/:view permits an authenticated… |
CVE-2026-54746 | Medium | 6.4 | 2026-08-28 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does… |
CVE-2026-81299 | Medium | 4.3 | 2026-08-28 | Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions. |
CVE-2026-37236 | Critical | 9.8 | 2026-08-28 | grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restr… |
CVE-2026-79995 | Medium | 4.3 | 2026-08-28 | The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the… |
CVE-2026-79615 | Low | 2.7 | 2026-08-28 | The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not check authorisation when returning question bank entries through one of its REST API… |
CVE-2026-81817 | | 2026-08-27 | Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The rout… | |
CVE-2026-81668 | Medium | 5.4 | 2026-08-27 | A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated… |
CVE-2026-81658 | Medium | 6.5 | 2026-08-27 | A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authen… |
CVE-2026-17562 | Medium | 6.5 | 2026-08-27 | Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by… |
CVE-2026-81576 | High | 7.7 | 2026-08-27 | If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole au… |
CVE-2026-78139 | Medium | 4.3 | 2026-08-27 | The Notifima WordPress plugin before 3.1.4 does not verify that the caller owns the subscription being modified on one of its REST endpoints in all versions u… |
CVE-2026-77990 | | 2026-08-27 | Joomla Extension - joomlaeventmanager.net - Attendee lists readable by any logged-in user in Joomla Event Manager < 5.0.1 - A non-manager can therefore read at… | |
CVE-2026-77035 | | 2026-08-27 | Joomla Extension - joomlaeventmanager.net - Cross-user event and venue takeover through forged form fields in Joomla Event Manager < 5.0.1 - A registered user… | |
CVE-2026-16568 | Medium | 4.3 | 2026-08-27 | The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user o… |
CVE-2026-16567 | Medium | 5.3 | 2026-08-27 | The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauth… |
CVE-2026-69129 | | 2026-08-26 | KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster acce… | |
CVE-2026-77368 | High | 7.6 | 2026-08-26 | SeaweedFS is a distributed storage system for files and blobs. In version 4.39, the filer's TUS resumable-upload handler checks JWT allowed_prefixes scoping on… |
CVE-2026-65642 | | 2026-08-26 | Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other custom… | |
CVE-2026-75415 | High | 7.5 | 2026-08-26 | AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of t… |
CVE-2026-55228 | High | 8.1 | 2026-08-26 | Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforc… |
CVE-2026-74771 | Medium | 6.5 | 2026-08-26 | Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with r… |
CVE-2026-54256 | Medium | 5.4 | 2026-08-26 | Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget truste… |
CVE-2026-81031 | High | 7.2 | 2026-08-26 | IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler in backend/src/controll… |
CVE-2026-54553 | Medium | 5.4 | 2026-08-26 | Starlette-Admin is a fast, beautiful and extensible administrative interface framework for FastAPI and Starlette applications. Prior to 0.16.1, the list API do… |
CVE-2026-3235 | Medium | 5.3 | 2026-08-26 | The WP Data Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.5.68 via the 'check_app_acces… |
CVE-2026-79654 | Medium | 4.3 | 2026-08-26 | A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An… |
CVE-2026-77789 | Medium | 4.3 | 2026-08-26 | The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting cust… |
CVE-2026-74930 | Medium | 4.3 | 2026-08-26 | The Project Manager WordPress plugin before 4.0.7 does not check that the user whose activity is being requested is the one making the request in one of its R… |
CVE-2026-14212 | Medium | 4.7 | 2026-08-26 | The Booking for Appointments and Events Calendar WordPress plugin before 9.8 does not verify that an authenticated employee (provider) owns the provider accou… |
CVE-2026-13404 | Medium | 5.3 | 2026-08-26 | The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check (relying only on a publicly-scrapeable nonc… |
CVE-2026-80197 | Medium | 4.3 | 2026-08-26 | Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to mani… |
CVE-2026-62861 | | 2026-08-25 | TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make t… | |
CVE-2026-80049 | High | 8.8 | 2026-08-25 | Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised iden… |
CVE-2026-78581 | Medium | 4.2 | 2026-08-25 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized data modification via Accessing Functionality Not Properly Constr… |
CVE-2026-77998 | | 2026-08-25 | Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On –… | |
CVE-2026-77145 | | 2026-08-25 | The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event… | |
CVE-2026-77143 | | 2026-08-25 | The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows… | |
CVE-2026-77142 | | 2026-08-25 | The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own… | |
CVE-2026-77141 | | 2026-08-25 | The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no owner… | |
CVE-2026-77140 | | 2026-08-25 | The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An… | |
CVE-2026-77135 | | 2026-08-25 | The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to t… | |
CVE-2026-77127 | | 2026-08-25 | The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privil… | |
CVE-2026-56093 | | 2026-08-25 | The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular searc… | |
CVE-2026-10630 | Medium | 4.3 | 2026-08-25 | The WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses plugin for WordPress is vulnerable to Insecure Direct Objec… |
CVE-2026-5006 | Medium | 6.8 | 2026-08-24 | A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may manipulate an identity value reference… |
CVE-2026-71507 | Medium | 6.5 | 2026-08-24 | Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API company bank account write routes that allows authenticated a… |
CVE-2026-71505 | High | 7.1 | 2026-08-24 | Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticat… |
CVE-2026-76073 | High | 8.8 | 2026-08-24 | Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset… |
CVE-2026-77995 | | 2026-08-24 | Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak… | |
CVE-2026-78365 | | 2026-08-24 | Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and… | |
CVE-2026-78278 | Medium | 5.3 | 2026-08-24 | Subscriber Insecure Direct Object References (IDOR) in Fluent Boards Pro <= 2.0.11 versions. |
CVE-2026-78203 | High | 7.1 | 2026-08-24 | Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from o… |
CVE-2026-78160 | Medium | 6.3 | 2026-08-24 | A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/note.php of the compon… |
CVE-2026-78144 | Medium | 6.3 | 2026-08-23 | A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality o… |