CWE-639 · Authorization Bypass Through User-Controlled Key (page 7)
Page 7 of 29 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-72657 | Medium | 6.5 | 2026-08-13 | Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipulating User-Controlled Variables (CAPEC… |
CVE-2026-72650 | Medium | 4.3 | 2026-08-13 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by… |
CVE-2026-72629 | High | 7.1 | 2026-08-13 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized cross-space access via Accessing Functionality Not Properly Const… |
CVE-2026-73644 | Critical | 9.6 | 2026-08-13 | OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/se… |
CVE-2026-72741 | High | 8.1 | 2026-08-13 | Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized ent… |
CVE-2026-58445 | Low | 2.7 | 2026-08-13 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API |
CVE-2026-58435 | Medium | 5.4 | 2026-08-13 | Gitea LFS Deploy-Key Privilege Escalation |
CVE-2026-58432 | Medium | 5.9 | 2026-08-13 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive… |
CVE-2026-57886 | Medium | 5.9 | 2026-08-13 | Cross-repository issue/comment attachment re-linking can expose private attachment content |
CVE-2026-19734 | | 2026-08-13 | Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows… | |
CVE-2026-28155 | Medium | 6.5 | 2026-08-13 | Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions. |
CVE-2026-73616 | Medium | 6.5 | 2026-08-13 | OpenRemote notification deletion endpoints fail to enforce realm boundaries, allowing any realm administrator to delete notifications belonging to other realms… |
CVE-2026-73612 | High | 8.1 | 2026-08-13 | File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users… |
CVE-2026-73610 | Medium | 5.8 | 2026-08-13 | SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only… |
CVE-2026-73606 | Medium | 5.8 | 2026-08-13 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected docum… |
CVE-2026-73488 | Medium | 6.5 | 2026-08-13 | Flowise versions before 3.1.3 contain an insecure direct object reference vulnerability in the GET /api/v1/organization/customer-default-source endpoint that a… |
CVE-2026-18945 | High | 8.2 | 2026-08-13 | The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the relate… |
CVE-2026-14213 | Low | 3.7 | 2026-08-13 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the ap… |
CVE-2026-18750 | Medium | 5.3 | 2026-08-12 | vinny/views.py: (ModifyEmailNotifications) IDOR: view fetches VinceCommEmail by raw pk from URL and toggles email_function/name without checking the record's c… |
CVE-2026-18749 | Critical | 9.8 | 2026-08-12 | The type=track branch authorises on _is_my_case(t_attach.case) only and never checks VinceTrackAttachment.shared. A coordinator-uploaded case artefact that has… |
CVE-2026-18744 | Medium | 6.5 | 2026-08-12 | Any authenticated case participant can fetch any OTHER vendor's CaseStatement + per-vul CaseMemberStatus by supplying that member's id — test_func only checks… |
CVE-2026-19130 | Medium | 5.8 | 2026-08-12 | A flaw was found in the provider-credential-controller component of multicluster-engine (MCE). An attacker with specific permissions on the hub cluster, and kn… |
CVE-2026-73303 | High | 8.2 | 2026-08-12 | Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without bindin… |
CVE-2026-72802 | Medium | 5.3 | 2026-08-12 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that returns absolute filesystem paths unmodifie… |
CVE-2026-19228 | High | 8.5 | 2026-08-12 | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allo… |
CVE-2026-73298 | | 2026-08-12 | The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving cont… | |
CVE-2026-73239 | Medium | 6.5 | 2026-08-12 | Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: befor… |
CVE-2026-68076 | Medium | 5.4 | 2026-08-12 | Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent thi… |
CVE-2026-47231 | High | 8.1 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` gates state-changing modes by checking that the acto… |
CVE-2026-47230 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_rename_save` shares the same root-cause s… |
CVE-2026-47227 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. `modules/categories.php` checks that the supplied `type` parameter (`ANN`, `EVT`, `ROL`, `USF`, …) correspo… |
CVE-2026-47226 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanent… |
CVE-2026-18962 | Medium | 4.3 | 2026-08-12 | The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they target when it process… |
CVE-2026-16737 | Medium | 5.3 | 2026-08-12 | The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one… |
CVE-2026-14858 | Medium | 4.3 | 2026-08-12 | The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subs… |
CVE-2026-14857 | Medium | 4.3 | 2026-08-12 | The WP Crowdfunding WordPress plugin before 2.2.1 does not verify ownership of a campaign before allowing its update history to be modified and a notification… |
CVE-2026-13612 | Medium | 4.3 | 2026-08-12 | The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level user… |
CVE-2026-13177 | Medium | 4.3 | 2026-08-12 | The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and abo… |
CVE-2026-66878 | High | 7.7 | 2026-08-12 | A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription r… |
CVE-2026-64927 | Medium | 6.4 | 2026-08-12 | A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles… |
CVE-2026-48765 | Critical | 9.9 | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 allow a low-privilege read collaborator to extract a workspace OAuth `credentialsId` from a readabl… |
CVE-2026-19579 | Medium | 5.4 | 2026-08-11 | Snipe-IT before 8.6.0 contains an authorization bypass (insecure direct object reference) in the asset checkout-request cancellation endpoint. The cancel_by_ad… |
CVE-2026-69119 | High | 8.3 | 2026-08-11 | Taubyte Tau v1.1.10 contains a missing authorization vulnerability in the services/auth HTTP service that allows any authenticated user to read or permanently… |
CVE-2026-69117 | Medium | 6.5 | 2026-08-11 | NetBox 4.5.8 contains an ORM injection vulnerability that allows authenticated attackers, including those with read-only API tokens, to inject arbitrary Django… |
CVE-2026-48494 | | 2026-08-11 | TypeBot is a chatbot builder tool. In version 3.16.1, an authenticated user who has read access to any typebot can resume a WhatsApp preview webhook session th… | |
CVE-2026-58650 | High | 7.8 | 2026-08-11 | Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
CVE-2026-47704 | | 2026-08-11 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, an authenticated user who has read access to any typebot can resume a waiting webhook session that… | |
CVE-2026-73068 | Medium | 5.9 | 2026-08-11 | ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet… |
CVE-2026-56721 | High | 8.8 | 2026-08-11 | CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-p… |
CVE-2026-72774 | Medium | 6.5 | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shar… |
CVE-2026-72763 | Medium | 6.5 | 2026-08-11 | n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execut… |
CVE-2026-72547 | High | 7.1 | 2026-08-11 | An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to bulk import attendees into ev… |
CVE-2026-72546 | High | 7.1 | 2026-08-11 | An insecure direct object reference vulnerability in Attendize through commit 9289acb allows any authenticated event organiser to inject attendees and orders i… |
CVE-2026-72545 | High | 7.5 | 2026-08-11 | An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact recor… |
CVE-2026-72543 | High | 7.5 | 2026-08-11 | An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact recor… |
CVE-2026-19424 | High | 7.5 | 2026-08-11 | Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific par… |
CVE-2026-66764 | Medium | 4.3 | 2026-08-11 | Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have… |
CVE-2026-18620 | High | 7.1 | 2026-08-10 | A flaw was found in Data Science Pipelines. A restricted user, or tenant, can exploit an improper authorization vulnerability in the setDefaultServiceAccount f… |
CVE-2026-72876 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in… |
CVE-2026-69114 | Medium | 6.5 | 2026-08-10 | Spacebar Server before commit 8d126f4 contains a cross-channel message deletion vulnerability in the single-delete and bulk-delete message handlers that fail t… |
CVE-2026-72863 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's WebSocket handlers (in-app terminals and log streamers) authenticate… |
CVE-2026-68872 | Medium | 6.5 | 2026-08-10 | The AWS Systems Manager Parameter Store and Secrets Manager backends in Apache Airflow's Amazon provider resolved a team-scoped Connection or Variable id throu… |
CVE-2026-68871 | Medium | 6.5 | 2026-08-10 | The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when t… |
CVE-2026-68870 | Medium | 5.3 | 2026-08-10 | The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic loo… |
CVE-2026-72737 | Critical | 9.6 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/do… |
CVE-2026-72734 | High | 8.4 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). From 0.28.7 until 0.29.13, the server.remove tRPC mutation in apps/dokploy/server/api/routers/se… |
CVE-2026-72724 | Medium | 4.3 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Th… |
CVE-2026-19433 | | 2026-08-10 | Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any… | |
CVE-2026-72690 | High | 7.1 | 2026-08-10 | An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey quest… |
CVE-2026-72689 | High | 7.5 | 2026-08-10 | A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete cont… |
CVE-2026-59233 | | 2026-08-10 | Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, includin… | |
CVE-2026-72564 | Critical | 9.6 | 2026-08-10 | An improper authorization vulnerability in fosrl/pangolin through v1.20.0 allows an authenticated remote attacker to authenticate to any resource in any organi… |
CVE-2026-19077 | Medium | 6.5 | 2026-08-10 | The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user who… |
CVE-2026-18200 | Medium | 4.3 | 2026-08-10 | The FoodBoxBooker WordPress plugin before 1.0.8 does not verify that the user account being updated belongs to the user making the request, allowing authentica… |
CVE-2026-17020 | Medium | 4.3 | 2026-08-10 | The Salon Booking System WordPress plugin through 10.31.0 does not verify that a requested booking belongs to the caller on one of its REST API endpoints, req… |
CVE-2026-17018 | Medium | 4.9 | 2026-08-10 | The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested… |
CVE-2026-15238 | Medium | 5.4 | 2026-08-10 | The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user wi… |
CVE-2026-14211 | Low | 3.8 | 2026-08-10 | The Booking for Appointments and Events Calendar WordPress plugin before 9.7 does not verify that an authenticated employee (provider) is related to the custo… |
CVE-2026-16957 | Low | 2.7 | 2026-08-09 | The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, al… |
CVE-2026-16953 | Medium | 4.8 | 2026-08-08 | The AI Engine WordPress plugin before 3.6.4 does not verify ownership of a guest's uploaded chatbot files before deletion, authorising the action solely by a… |
CVE-2026-16574 | Medium | 5.4 | 2026-08-08 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the r… |
CVE-2026-48169 | High | 8.8 | 2026-08-07 | PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace is… |
CVE-2026-70561 | Medium | 6.5 | 2026-08-07 | TestLink 1.9.20 and prior contains an insecure direct object reference vulnerability that allows any authenticated user, including low-privilege guest accounts… |
CVE-2026-66058 | | 2026-08-07 | Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for a… | |
CVE-2026-16039 | Medium | 6.5 | 2026-08-07 | The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, includ… |
CVE-2026-15214 | Medium | 4.3 | 2026-08-07 | The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify that the requester owns the subscription being viewed before rendering its deta… |
CVE-2026-70557 | Medium | 6.5 | 2026-08-06 | diboot-core's POST /common/load-related-data endpoint resolves caller-supplied field names to any @TableField column of any entity and returns those values for… |
CVE-2026-67622 | Critical | 9.9 | 2026-08-06 | Flowise through 3.1.4 contains an insecure direct object reference vulnerability in the OpenAI Assistants integration that allows authenticated attackers to ac… |
CVE-2026-64662 | Medium | 6.5 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from… |
CVE-2026-45414 | High | 8.5 | 2026-08-06 | Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organiza… |
CVE-2026-19111 | High | 8.1 | 2026-08-06 | Insecure direct object reference in the mongodb_memory, elasticsearch_memory, and mem0_memory tools in Amazon Strands Agents Tools before 0.8.3 might allow rem… |
CVE-2026-19066 | Medium | 4.3 | 2026-08-06 | A vulnerability was identified in SourceCodester Online Examination & Learning Management System 1.0. Impacted is an unknown function of the file view_students… |
CVE-2026-19064 | Medium | 4.3 | 2026-08-06 | A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of the file /view.php… |
CVE-2026-15147 | Medium | 5.3 | 2026-08-06 | The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate th… |
CVE-2026-14842 | Medium | 5.3 | 2026-08-06 | The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated… |
CVE-2026-14306 | Medium | 4.3 | 2026-08-06 | The Tutor LMS WordPress plugin before 3.9.14 does not properly verify enrollment when restricting access to protected course content, allowing authenticated us… |
CVE-2026-13399 | High | 7.5 | 2026-08-06 | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticate… |
CVE-2026-10599 | High | 7.5 | 2026-08-06 | The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order being marked a… |
CVE-2026-18275 | Medium | 6.5 | 2026-08-06 | Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segme… |
CVE-2026-18258 | High | 8.8 | 2026-08-06 | Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote a… |