CWE-639 · Authorization Bypass Through User-Controlled Key (page 6)
Page 6 of 29 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-78142 | Medium | 6.3 | 2026-08-23 | A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. This impacts an unknown function of the file /archived_records.ph… |
CVE-2026-77116 | Medium | 4.3 | 2026-08-23 | Brave Popup Builder (slug: brave-popup-builder) has a broken access control issue in versions through 0.8.5. Any logged-in user - Subscriber or WooCommerce Cus… |
CVE-2026-14187 | Low | 2.7 | 2026-08-22 | The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor rol… |
CVE-2026-62283 | Critical | 9.9 | 2026-08-21 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9… |
CVE-2026-67360 | | 2026-08-21 | Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply an… | |
CVE-2026-67359 | | 2026-08-21 | Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orde… | |
CVE-2026-67358 | | 2026-08-21 | Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order t… | |
CVE-2026-77780 | | 2026-08-21 | Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transacti… | |
CVE-2026-77776 | Critical | 9.1 | 2026-08-21 | Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handl… |
CVE-2026-77759 | | 2026-08-21 | Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read th… | |
CVE-2026-77769 | Medium | 6.5 | 2026-08-21 | The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardId(dashboardId). The… |
CVE-2026-77768 | Medium | 6.5 | 2026-08-21 | The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportById(reportId) directly. The enforceAccess middl… |
CVE-2026-19085 | Low | 2.7 | 2026-08-21 | The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegat… |
CVE-2026-69558 | High | 8.6 | 2026-08-20 | Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network. |
CVE-2026-62945 | Medium | 4.3 | 2026-08-20 | TREK is a collaborative travel planner. Prior to 3.1.3, TREK file upload, update, and link actions accept attacker-controlled reservation_id, place_id, and ass… |
CVE-2026-55489 | Medium | 4.9 | 2026-08-20 | BigBlueButton is an open-source virtual classroom. Prior to 3.0.29, BigBlueButton presenters could submit a presentationId through /api/graphql that identified… |
CVE-2026-63003 | Medium | 6.5 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-le… |
CVE-2026-61663 | Medium | 4.3 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to au… |
CVE-2026-54622 | Medium | 6.5 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/ad… |
CVE-2026-76634 | Medium | 6.5 | 2026-08-20 | WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitr… |
CVE-2026-64969 | | 2026-08-20 | ATutor is vulnerable to Insecure Direct Object Reference (IDOR) attack in profile picture related endpoints. Any authenticated user, including a student, can s… | |
CVE-2026-64961 | | 2026-08-20 | ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token val… | |
CVE-2026-77081 | High | 7.1 | 2026-08-20 | n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter i… |
CVE-2026-77079 | High | 8.8 | 2026-08-20 | n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with… |
CVE-2026-77073 | Medium | 4.3 | 2026-08-20 | n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authentication type is set to an expression. A… |
CVE-2026-76397 | High | 8.1 | 2026-08-19 | In Splunk AI Toolkit versions below 6.0.0, a user who holds the "power" Splunk role could access and delete all relevant data in experiment history, including… |
CVE-2026-76263 | Medium | 5.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete Splunk Processing Language ver… |
CVE-2026-59992 | Medium | 5.4 | 2026-08-19 | Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary… |
CVE-2026-53548 | Critical | 9.6 | 2026-08-19 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.6.1, the GET /host/db/host/:id/passwor… |
CVE-2026-53546 | Critical | 9.6 | 2026-08-19 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a… |
CVE-2026-76647 | High | 8.8 | 2026-08-19 | Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php… |
CVE-2026-68559 | Medium | 6.5 | 2026-08-19 | Wekan is open source kanban built with Meteor. From 9.57 until 9.74, the /api/boards/:boardId/exportExcel route in models/exportExcel.js called the asynchronou… |
CVE-2026-55694 | Medium | 6.5 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.3, a restricted user can request /api/v1/users/{target_id}/eulas to obtain another user's rando… |
CVE-2026-55482 | Medium | 6.3 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update() to su… |
CVE-2026-18315 | Critical | 9.8 | 2026-08-19 | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key leading to Acc… |
CVE-2026-62666 | High | 8.8 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::creat… |
CVE-2026-75951 | | 2026-08-19 | Joomla Extension - cmsjunkie.com - Insecure Direct Object Reference (multiple frontend/API actions) in J-BusinessDirectory < 6.2.3 | |
CVE-2026-75950 | | 2026-08-19 | Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3 - Ownership could be changed using attacker-suppli… | |
CVE-2026-76237 | | 2026-08-19 | stigmem-node before 0.9.0a12 contains a broken object level authorization (cross-tenant BOLA) vulnerability in the quarantine review endpoints. On multi-tenant… | |
CVE-2026-76236 | | 2026-08-19 | stigmem-node before 0.9.0a12 contains a cross-tenant broken object level authorization (BOLA) flaw in the RTBF (right-to-be-forgotten) tombstone mechanism. iss… | |
CVE-2026-76216 | High | 7.5 | 2026-08-19 | Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id ==… |
CVE-2026-51367 | High | 7.5 | 2026-08-19 | An issue in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to obtain sensitive information via the api_vedo/chat endpoint and the utente_ch… |
CVE-2026-19417 | Medium | 6.5 | 2026-08-19 | The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient… |
CVE-2026-19416 | Medium | 4.3 | 2026-08-19 | The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level… |
CVE-2026-16979 | Medium | 4.3 | 2026-08-19 | The SmartCrawl SEO checker, analyzer & optimizer WordPress plugin before 3.16.3 does not perform capability checks on two of its AJAX actions, allowing users w… |
CVE-2026-16058 | Medium | 5.3 | 2026-08-19 | The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are… |
CVE-2026-14861 | High | 7.5 | 2026-08-19 | The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the… |
CVE-2026-14826 | Low | 2.7 | 2026-08-19 | The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-no… |
CVE-2026-14825 | Low | 2.7 | 2026-08-19 | The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check before saving a quiz's front-end text settings… |
CVE-2026-14196 | Medium | 4.3 | 2026-08-19 | The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, all… |
CVE-2026-13175 | Medium | 6.5 | 2026-08-19 | The Eventin WordPress plugin before 4.1.21 does not verify ownership before allowing schedule records to be modified or deleted, allowing users with contribut… |
CVE-2026-13169 | High | 8.1 | 2026-08-19 | The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a diffe… |
CVE-2026-71417 | High | 7.3 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another ce… |
CVE-2026-71308 | High | 8.1 | 2026-08-18 | Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers t… |
CVE-2026-55166 | Critical | 9.9 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destina… |
CVE-2026-69160 | Medium | 6.5 | 2026-08-18 | OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasP… |
CVE-2026-50167 | | 2026-08-18 | Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook… | |
CVE-2026-61574 | High | 8.8 | 2026-08-18 | authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any… |
CVE-2026-49228 | High | 8.8 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allo… |
CVE-2026-49225 | High | 8.3 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operat… |
CVE-2026-49224 | High | 8.3 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post revision operation… |
CVE-2026-49223 | High | 7.6 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product review operatio… |
CVE-2026-49222 | High | 7.6 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operat… |
CVE-2026-19869 | | 2026-08-18 | @neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authe… | |
CVE-2026-49227 | High | 7.6 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend comment operations allo… |
CVE-2026-49226 | High | 8.3 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend post operations allow a… |
CVE-2026-49221 | High | 8.8 | 2026-08-18 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operation… |
CVE-2026-45120 | Medium | 5.4 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewin… |
CVE-2026-74009 | Medium | 5.3 | 2026-08-18 | Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions. |
CVE-2026-73395 | Medium | 6.5 | 2026-08-18 | Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions. |
CVE-2026-69189 | High | 7.6 | 2026-08-18 | Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLS… |
CVE-2026-66634 | Medium | 4.3 | 2026-08-18 | Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions. |
CVE-2026-16309 | Medium | 5.3 | 2026-08-18 | Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrain… |
CVE-2026-63178 | Medium | 6.5 | 2026-08-17 | Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/… |
CVE-2026-75105 | High | 7.5 | 2026-08-17 | phpIPAM through 1.8.1 fails to verify that a requested IP address belongs to the subnet a temporary share token was issued for. In app/temp_share/index.php and… |
CVE-2026-75103 | High | 8.8 | 2026-08-17 | Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password… |
CVE-2026-63669 | Medium | 6.5 | 2026-08-17 | ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent'… |
CVE-2026-74877 | High | 8.8 | 2026-08-17 | openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revo… |
CVE-2026-19997 | Medium | 4.7 | 2026-08-17 | A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown processing of the file /admin/sales/rma/requests of the comp… |
CVE-2026-19994 | Medium | 6.3 | 2026-08-17 | A vulnerability was found in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/configuration/cache-management… |
CVE-2026-14832 | Medium | 5.3 | 2026-08-17 | The ShopSmart Loyalty for WooCommerce WordPress plugin through 1.0.0 does not perform any authorization or ownership check on a phone-number lookup exposed to… |
CVE-2026-19979 | High | 8.3 | 2026-08-17 | A vulnerability was identified in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X20… |
CVE-2026-19966 | Medium | 5.4 | 2026-08-17 | A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save_conta… |
CVE-2026-12998 | Medium | 5.3 | 2026-08-16 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2026-13358 | Medium | 6.5 | 2026-08-16 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all ve… |
CVE-2026-12905 | Medium | 4.3 | 2026-08-16 | The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment() method of the Mo… |
CVE-2025-10005 | Medium | 4.3 | 2026-08-16 | The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2026-16142 | Critical | 9.8 | 2026-08-15 | The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() A… |
CVE-2026-74242 | Medium | 5.3 | 2026-08-14 | A flaw was found in Red Hat Quay. An administrator of any repository, by knowing or guessing a target notification's Universally Unique Identifier (UUID), can… |
CVE-2026-19838 | Medium | 4.3 | 2026-08-14 | A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the co… |
CVE-2026-19836 | Medium | 4.3 | 2026-08-14 | A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of th… |
CVE-2026-19834 | Medium | 4.7 | 2026-08-14 | A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component… |
CVE-2026-19870 | | 2026-08-14 | Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read p… | |
CVE-2026-19784 | Medium | 4.3 | 2026-08-14 | A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation caus… |
CVE-2026-73841 | High | 8.8 | 2026-08-13 | OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.1.6 and 1.2.3, internal/openchoreo-api/api/handlers/exec.go and internal/op… |
CVE-2026-73657 | Medium | 4.2 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.4, `POST /api/v1/runs/:runParam/replay` i… |
CVE-2026-73039 | Medium | 5.4 | 2026-08-13 | streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' v… |
CVE-2026-73656 | Critical | 9.9 | 2026-08-13 | Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-w… |
CVE-2026-72680 | Medium | 6.5 | 2026-08-13 | Kibana Agent Builder A2A JSON-RPC API endpoint derives the identifier of a stored conversation from a user-supplied input, and the ownership check on that iden… |
CVE-2026-72666 | Medium | 6.8 | 2026-08-13 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kib… |