CWE-639 · Authorization Bypass Through User-Controlled Key (page 9)
Page 9 of 29 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-65016 | High | 8.8 | 2026-07-22 | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a privilege escalation vulnerability in Enterprise SSO instance-role provisioning. The provisioning pa… |
CVE-2026-2406 | Medium | 6.5 | 2026-07-22 | Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow… |
CVE-2026-63259 | Medium | 4.3 | 2026-07-21 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled… |
CVE-2026-65316 | Medium | 6.5 | 2026-07-21 | XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups… |
CVE-2026-61064 | Medium | 5.4 | 2026-07-21 | Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Install / Upgrade Issues). Supported versions that are affected are 12… |
CVE-2026-56147 | High | 7.1 | 2026-07-21 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized information disclosure and case attachment integrity compromise v… |
CVE-2026-47419 | High | 8.3 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an* Insecure Direct Object Reference. The age… |
CVE-2026-47418 | High | 8.1 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The proj… |
CVE-2026-47417 | High | 8.1 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The comm… |
CVE-2026-47415 | High | 8.3 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The issu… |
CVE-2026-47414 | High | 7.6 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. Five lab… |
CVE-2026-47408 | Medium | 6.5 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The `GET… |
CVE-2026-47407 | | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the Platform server exposes resources under `/api/… | |
CVE-2026-47406 | High | 8.1 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The depe… |
CVE-2026-47399 | High | 8.8 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Prior to version 0.1.4, the workspace-scoped REST routes contain a systemi… |
CVE-2026-15342 | Medium | 6.5 | 2026-07-21 | Plane contains a multi‑tenant authorization flaw in its asset‑management API that allows authenticated users from one workspace to access, delete, or duplicate… |
CVE-2026-28317 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain adm… |
CVE-2026-28316 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with… |
CVE-2026-28314 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impa… |
CVE-2026-28313 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover… |
CVE-2026-28308 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access i… |
CVE-2026-28305 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with… |
CVE-2026-28302 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as ro… |
CVE-2026-16450 | Medium | 4.3 | 2026-07-21 | A vulnerability was identified in zsadmin2025 ZS-Admin up to b52e14536d59fda11e56e2536a1c32e82a38cead. This affects the function getTenantId of the file /api/s… |
CVE-2026-14184 | Medium | 5.4 | 2026-07-21 | The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing aut… |
CVE-2026-14183 | Medium | 4.3 | 2026-07-21 | The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, al… |
CVE-2026-57494 | | 2026-07-20 | AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail age… | |
CVE-2026-55544 | High | 7.6 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations ove… |
CVE-2026-47198 | High | 8.5 | 2026-07-20 | Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.1, the checkout component improperly filters… |
CVE-2026-47130 | High | 7.1 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Object Level Authorization (BOLA/IDOR) vulnerabi… |
CVE-2026-44585 | Medium | 5.4 | 2026-07-20 | Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a use… |
CVE-2026-13381 | High | 8.1 | 2026-07-20 | VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker… |
CVE-2026-45295 | Medium | 6.5 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint `GET /thread/read/{conv… |
CVE-2026-63763 | High | 8.8 | 2026-07-20 | SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., those with the database… |
CVE-2026-63745 | Medium | 5.4 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing t… |
CVE-2026-63735 | High | 8.1 | 2026-07-20 | SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in differe… |
CVE-2026-16217 | Medium | 6.3 | 2026-07-19 | A security vulnerability has been detected in guohongze adminset up to 0.61. Affected by this vulnerability is an unknown functionality of the file delivery/de… |
CVE-2026-16214 | Medium | 6.3 | 2026-07-19 | A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashbo… |
CVE-2026-16075 | Medium | 4.3 | 2026-07-18 | A flaw has been found in AstrBotDevs AstrBot up to 4.25.5. This vulnerability affects the function OpenApiRoute.get_chat_sessions of the file astrbot/dashboard… |
CVE-2026-55518 | Critical | 9.6 | 2026-07-17 | Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<associati… |
CVE-2026-13445 | High | 8.1 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files… |
CVE-2026-48016 | Medium | 4.3 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment in src/Core/Checkout/Payment/SalesChan… |
CVE-2026-63307 | Medium | 6.5 | 2026-07-17 | Chat2DB before 5.3.0 contains an insecure direct object reference vulnerability in the GET /api/connection/datasource/{id} endpoint. The handler calls dataSour… |
CVE-2026-12693 | Critical | 9.4 | 2026-07-17 | Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrain… |
CVE-2026-11763 | Medium | 6.5 | 2026-07-17 | Authorization bypass through User-Controlled key vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Labor… |
CVE-2026-63099 | Medium | 6.5 | 2026-07-17 | TheHive through 4.1.24 contains a broken object-level authorization vulnerability in the attachment download endpoints that allows any authenticated user to ac… |
CVE-2026-63095 | Medium | 6.5 | 2026-07-17 | Dendrite through 0.13.8 contains an improper authorization vulnerability in the Matrix Client-Server API that allows any authenticated local user to delete thi… |
CVE-2026-22104 | | 2026-07-17 | Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracke… | |
CVE-2026-12393 | Medium | 5.4 | 2026-07-17 | The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allow… |
CVE-2026-11966 | Medium | 5.3 | 2026-07-17 | The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership paym… |
CVE-2026-15159 | Medium | 4.3 | 2026-07-17 | The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.6 via the 'spre… |
CVE-2026-62233 | High | 8.8 | 2026-07-17 | grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write ma… |
CVE-2026-43977 | High | 7.5 | 2026-07-16 | wger is a free, open-source workout and fitness manager. In versions prior to 2.6, any authenticated user can read another user's private workout session notes… |
CVE-2026-11889 | Medium | 6.5 | 2026-07-16 | SALTO ProAccess Space software using the tenancy feature / logical partition is vulnerable to a privilege escalation attack that could allow an authorized at… |
CVE-2026-53536 | | 2026-07-16 | Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT against… | |
CVE-2026-15945 | Medium | 4.3 | 2026-07-16 | A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a del… |
CVE-2026-57205 | Medium | 4.3 | 2026-07-16 | SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated… |
CVE-2026-54568 | Medium | 4.3 | 2026-07-16 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket se… |
CVE-2026-59237 | | 2026-07-16 | Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a re… | |
CVE-2025-71388 | | 2026-07-16 | stoatchat (delta/Revolt) versions from 20241213-1 before 20250210-1 allow users with only ViewChannel (read) permission on a channel to fetch that channel's we… | |
CVE-2026-35147 | High | 8.2 | 2026-07-16 | HCL DFXServer is affected by a Broken Authentication vulnerability via direct API access. The application fails to verify the user's authentication status when… |
CVE-2026-12906 | Low | 2.7 | 2026-07-16 | The RTMKit WordPress plugin before 2.0.9 does not perform a capability check in one of its AJAX actions and resolves a request-supplied post identifier directl… |
CVE-2026-12510 | Medium | 5.9 | 2026-07-16 | The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing use… |
CVE-2026-15909 | Medium | 6.3 | 2026-07-16 | A vulnerability has been found in RafyMrX TOKO-ONLINE-ROTI up to ddfe1cd587be0a0b5135d8b6e85cce2ec3aece99. Affected is an unknown function of the file proses/a… |
CVE-2026-55234 | High | 8.5 | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and ser… |
CVE-2026-53447 | Medium | 6.5 | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to buil… |
CVE-2026-54052 | Critical | 9.9 | 2026-07-15 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-ten… |
CVE-2026-52869 | High | 7.1 | 2026-07-15 | The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and stateful Streamable HTTP t… |
CVE-2026-58660 | High | 8.1 | 2026-07-15 | Kanboard through 1.2.52, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's ro… |
CVE-2026-48799 | High | 7.7 | 2026-07-15 | Postiz is an AI social media scheduling tool. Prior to 2.21.8, Postiz fails to verify Nowpayments IPN callback authenticity against the payment provider shared… |
CVE-2025-32781 | Medium | 6.5 | 2026-07-15 | Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verif… |
CVE-2026-44986 | Critical | 9.9 | 2026-07-15 | Penpot is an open-source design tool for design and code collaboration. Prior to 2.14.5, Penpot exposed teams_invitations.clj invitation tokens from create-tea… |
CVE-2026-61836 | High | 8.6 | 2026-07-15 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to 12.0.0, when response caching is enabled, the cache-key derivation in… |
CVE-2026-59259 | Medium | 6.5 | 2026-07-15 | n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the stati… |
CVE-2026-59254 | | 2026-07-15 | n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credent… | |
CVE-2026-59236 | | 2026-07-15 | Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM… | |
CVE-2026-59235 | | 2026-07-15 | Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.php), exposed at GET /api/bank-acc… | |
CVE-2026-11580 | Medium | 5.5 | 2026-07-15 | The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not perform a per-object capability check in its post-duplication AJA… |
CVE-2026-59733 | High | 8.8 | 2026-07-14 | Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-re… |
CVE-2026-15637 | High | 7.5 | 2026-07-14 | Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileg… |
CVE-2026-15058 | Low | 3.1 | 2026-07-14 | Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user'… |
CVE-2026-52841 | Low | 3.1 | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. In versions prior to 1.6.0, `Google::oauth` at `application/controllers/Google.php:278` stores its UR… |
CVE-2026-52839 | Low | 3.3 | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` re… |
CVE-2026-52837 | | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. In versions up to and including 1.5.2, the booking reschedule view at `/index.php/booking/reschedule/… | |
CVE-2026-9341 | Medium | 4.3 | 2026-07-14 | The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions u… |
CVE-2026-15389 | | 2026-07-14 | A vulnerability relating to insufficient access control has been identified in the session management of the Sesame Time web application and its REST v3 API. T… | |
CVE-2026-15622 | Medium | 5.3 | 2026-07-14 | A flaw has been found in poco-ai poco-claw up to 0.5.4. Affected is the function get_workspace_file of the file executor_manager/app/api/v1/workspace.py of the… |
CVE-2026-58410 | High | 7.1 | 2026-07-13 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authorization flaw in the family-scoped endpoints which allowed low-… |
CVE-2026-6541 | Medium | 4.3 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric configuration changes to the playbook being saved, which al… |
CVE-2026-61971 | Low | 2.7 | 2026-07-13 | Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Config… |
CVE-2026-57694 | Medium | 6.5 | 2026-07-13 | Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-9708 | Medium | 4.9 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an assigned incoming webhook user has access to the target te… |
CVE-2026-10103 | Medium | 4.3 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which all… |
CVE-2026-14165 | High | 7.5 | 2026-07-13 | An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access… |
CVE-2026-15516 | Medium | 5.6 | 2026-07-13 | A vulnerability was detected in MacCMS Pro up to 2022.1000.3005. Impacted is the function step5 of the file application/install/controller/Index.php of the com… |
CVE-2026-10041 | Medium | 4.3 | 2026-07-11 | The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.27… |
CVE-2026-13116 | Medium | 4.3 | 2026-07-11 | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5… |
CVE-2026-55881 | | 2026-07-10 | OpenReplay is a self-hosted session replay suite. From 1.22.0 before 1.27.0, getFirstMob returned 15-second presigned S3 download URLs for a session's DOM-repl… | |
CVE-2026-55880 | High | 7.1 | 2026-07-10 | OpenReplay is a self-hosted session replay suite. In 1.27.0 and earlier, three dashboard and note mutation functions ran their SQL without the ownership predic… |
CVE-2026-55515 | Medium | 5.0 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the unaccepted-assets report delete endpoint authorizes only reports.view and deletes Checko… |