CWE-639 · Authorization Bypass Through User-Controlled Key (page 9)
Page 9 of 23 — CVEs classified under CWE-639, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-39331 | High | 8.1 | 2026-04-07 | ChurchCRM is an open-source church management system. Prior to 7.1.0, an authenticated API user can modify any family record's state without proper authorizati… |
CVE-2026-39384 | High | 7.6 | 2026-04-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, FreeScout does not take the limit_user_customer_visibility… |
CVE-2026-35584 | Medium | 6.5 | 2026-04-07 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.212, the endpoint GET /thread/read/{conversation_id}/{thread_id… |
CVE-2026-35489 | High | 7.3 | 2026-04-07 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the POST /api/food/{id}/shopping/ endpoint… |
CVE-2026-5465 | High | 8.8 | 2026-04-07 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inc… |
CVE-2026-35183 | High | 7.1 | 2026-04-06 | Brave CMS is an open-source CMS. Prior to 2.0.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the article image deletion feature. It is l… |
CVE-2026-35173 | Medium | 6.5 | 2026-04-06 | Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, an IDOR / Mass Assignment issue exists in the Post model that allows authenticated users… |
CVE-2026-35045 | High | 8.1 | 2026-04-06 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.4, the PUT /api/recipe/batch_update/ endpoint… |
CVE-2026-34444 | Critical | 10.0 | 2026-04-06 | Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed thro… |
CVE-2026-31150 | Medium | 4.3 | 2026-04-06 | Incorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the shipping/receiving role to view the truck's dashboard resources. |
CVE-2026-4896 | High | 8.1 | 2026-04-04 | The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object R… |
CVE-2026-25197 | Critical | 9.1 | 2026-04-03 | A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call. |
CVE-2026-28736 | Medium | 4.3 | 2026-04-03 | ** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files. This allows an authenticated attacker who… |
CVE-2026-34832 | Medium | 6.5 | 2026-04-02 | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to version 1.66.1, Scoold contains an authenticated authorization flaw in feedback deletion t… |
CVE-2026-34584 | Medium | 5.4 | 2026-04-02 | listmonk is a standalone, self-hosted, newsletter and mailing list manager. From version 4.1.0 to before version 6.1.0, bugs in list permission checks allows u… |
CVE-2026-5326 | Medium | 5.3 | 2026-04-02 | A vulnerability was identified in SourceCodester Leave Application System 1.0. Impacted is an unknown function of the file /index.php?page=manage_user of the c… |
CVE-2026-5246 | Medium | 5.6 | 2026-04-02 | A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-… |
CVE-2026-5199 | | 2026-04-01 | A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster. Explo… | |
CVE-2026-3139 | Medium | 4.3 | 2026-03-31 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Ref… |
CVE-2026-32976 | Medium | 6.5 | 2026-03-31 | OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite co… |
CVE-2026-4400 | Medium | 6.5 | 2026-03-31 | Insecure Direct Object Reference (IDOR) vulnerability in 1millionbot Millie chat that allows private conversations of other users being viewed by simply changi… |
CVE-2026-33030 | High | 8.8 | 2026-03-30 | Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerabil… |
CVE-2026-3321 | | 2026-03-30 | A vulnerability of authorization bypass through user-controlled key in the 'console-survey/api/v1/answer/{EVENTID}/{TIMESTAMP}/' endpoint. Exploiting this vuln… | |
CVE-2026-3124 | High | 7.5 | 2026-03-30 | The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment(… |
CVE-2026-33946 | Medium | 5.9 | 2026-03-27 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb imple… |
CVE-2026-34046 | High | 8.8 | 2026-03-27 | Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/ap… |
CVE-2026-31950 | Medium | 5.3 | 2026-03-27 | LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc2 through 0.8.2-rc3, the SSE streaming endpoint `/api/agents/chat/stream/:streamId`… |
CVE-2026-4958 | Low | 3.1 | 2026-03-27 | A vulnerability has been found in OpenBMB XAgent 1.0.0. This affects the function ReplayServer.on_connect/ReplayServer.send_data of the file XAgentServer/appli… |
CVE-2026-33764 | Medium | 4.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the AI plugin's `save.json.php` endpoint loads AI response objects using an… |
CVE-2026-33759 | Medium | 5.3 | 2026-03-27 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.php` endpoint returns the full video cont… |
CVE-2026-1496 | | 2026-03-27 | Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable to an authenticatio… | |
CVE-2026-33735 | High | 8.8 | 2026-03-27 | MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypass in the `/api/settings/import-database… |
CVE-2026-33730 | Medium | 6.5 | 2026-03-27 | Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Prior to version 3.4.2, an Insec… |
CVE-2026-29071 | Low | 3.1 | 2026-03-27 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, any authenticated user can read othe… |
CVE-2026-28788 | High | 7.1 | 2026-03-27 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.8.6, any authenticated user can overwrite… |
CVE-2026-28503 | Medium | 6.5 | 2026-03-26 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. In versions prior to 2.6.0, the `SyncViewSet.query_synced_… |
CVE-2026-1206 | Medium | 4.3 | 2026-03-26 | The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all versions up to, and includ… |
CVE-2026-34055 | High | 8.1 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, the legacy patient notes fun… |
CVE-2026-33934 | Medium | 4.3 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have a missing authorization… |
CVE-2026-33931 | Medium | 6.5 | 2026-03-26 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Re… |
CVE-2026-32120 | Medium | 6.5 | 2026-03-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.3, an Insecure Direct Object Re… |
CVE-2025-14974 | Medium | 5.7 | 2026-03-25 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable due to Insecure Direct Object Reference (IDOR). |
CVE-2026-33724 | High | 7.4 | 2026-03-25 | n8n is an open source workflow automation platform. Prior to version 2.5.0, when the Source Control feature is configured to use SSH, the SSH command used for… |
CVE-2026-33663 | Medium | 6.5 | 2026-03-25 | n8n is an open source workflow automation platform. Prior to versions 2.14.1, 2.13.3, and 1.123.27, an authenticated user with the `global:member` role could e… |
CVE-2026-32535 | Medium | 6.5 | 2026-03-25 | Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Contro… |
CVE-2026-32533 | Medium | 6.5 | 2026-03-25 | Authorization Bypass Through User-Controlled Key vulnerability in LatePoint LatePoint latepoint allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-2414 | Critical | 9.8 | 2026-03-25 | Authorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege Escalation.This issue affects Server: from 9.5.2 before 10.7.2. |
CVE-2025-69347 | High | 8.6 | 2026-03-25 | Authorization Bypass Through User-Controlled Key vulnerability in Convers Lab WPSubscription subscription allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-33511 | Critical | 9.8 | 2026-03-24 | pyLoad is a free and open-source download manager written in Python. From version 0.4.20 to before version 0.5.0b3.dev97, the local_check decorator in pyLoad's… |
CVE-2026-33345 | Medium | 6.5 | 2026-03-24 | solidtime is an open-source time-tracking app. Prior to version 0.11.6, the project detail endpoint GET /api/v1/organizations/{org}/projects/{project} allows a… |
CVE-2026-33160 | Medium | 5.3 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, an unauthe… |
CVE-2026-33158 | Medium | 6.5 | 2026-03-24 | Craft CMS is a content management system (CMS). From version 4.0.0-RC1 to before version 4.17.8 and from version 5.0.0-RC1 to before version 5.9.14, a low-priv… |
CVE-2026-33700 | Medium | 4.9 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DELETE /api/v1/projects/:project/shares/:share` endpoint does not… |
CVE-2026-33678 | High | 8.1 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`WHERE id =… |
CVE-2026-33313 | Medium | 4.3 | 2026-03-24 | Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of wh… |
CVE-2026-33484 | High | 7.5 | 2026-03-24 | Langflow is a tool for building and deploying AI-powered agents and workflows. In versions 1.0.0 through 1.8.1, the `/api/v1/files/images/{flow_id}/{file_name}… |
CVE-2026-32300 | High | 8.1 | 2026-03-23 | Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0… |
CVE-2026-23488 | Medium | 5.3 | 2026-03-23 | Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the /api/v1/comment/create endpoint has an unauthorized access vulnerability, allowin… |
CVE-2026-23487 | Medium | 6.5 | 2026-03-23 | Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, there is an IDOR vulnerability where user.detail Endpoint Leaks the Superadmin Token… |
CVE-2026-30886 | Medium | 6.5 | 2026-03-23 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.11.4-alpha.2, an Insecure Direct Ob… |
CVE-2026-33297 | Critical | 9.1 | 2026-03-23 | WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to s… |
CVE-2026-4563 | Medium | 4.3 | 2026-03-23 | A weakness has been identified in MacCMS up to 2025.1000.4052. This vulnerability affects the function order_info of the file application/index/controller/User… |
CVE-2026-4549 | Low | 3.1 | 2026-03-22 | A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-p… |
CVE-2026-33425 | Medium | 5.3 | 2026-03-21 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, unauthenticated users can determine whether a spe… |
CVE-2026-33053 | High | 8.8 | 2026-03-20 | Langflow is a tool for building and deploying AI-powered agents and workflows. In versions prior to 1.9.0, the delete_api_key_route() endpoint accepts an api_k… |
CVE-2026-32114 | Medium | 4.3 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, there is an Insecure Direct Object Reference (IDO… |
CVE-2026-31869 | Medium | 4.3 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the ComposerController#mentions endpoint reveals… |
CVE-2026-32761 | Medium | 6.5 | 2026-03-20 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.0 and be… |
CVE-2026-32697 | Medium | 6.5 | 2026-03-20 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 8.9.3, the `RecordHandler::getRecor… |
CVE-2026-29189 | High | 8.1 | 2026-03-20 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to versions 7.15.1 and 8.9.3, the SuiteCRM REST… |
CVE-2026-32039 | Medium | 5.9 | 2026-03-19 | OpenClaw versions prior to 2026.2.22 contain an authorization bypass vulnerability in the toolsBySender group policy matching that allows attackers to inherit… |
CVE-2026-33304 | Medium | 6.5 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization bypass in the dated… |
CVE-2026-25744 | Medium | 6.5 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the encounter vitals API accepts an… |
CVE-2026-32867 | Medium | 5.4 | 2026-03-19 | OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/… |
CVE-2025-32223 | Medium | 6.5 | 2026-03-19 | Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-27397 | Medium | 6.5 | 2026-03-19 | Authorization Bypass Through User-Controlled Key vulnerability in Really Simple Plugins B.V. Really Simple Security Pro allows Exploiting Incorrectly Configure… |
CVE-2026-32638 | Low | 2.7 | 2026-03-18 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in StudioCMS uses the a… |
CVE-2026-25745 | Medium | 6.5 | 2026-03-18 | OpenEMR is a free and open source electronic health records and medical practice management application. In versions up to and including 8.0.0, the message/not… |
CVE-2026-32694 | Medium | 6.6 | 2026-03-18 | In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictabl… |
CVE-2026-30884 | Critical | 9.6 | 2026-03-18 | mdjnelson/moodle-mod_customcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser. Prior to ve… |
CVE-2026-26004 | Medium | 6.5 | 2026-03-18 | Sentry is a developer-first error tracking and performance monitoring tool. Versions prior to 26.1.0 have a cross-organization Insecure Direct Object Reference… |
CVE-2026-24901 | High | 8.1 | 2026-03-17 | Outline is a service that allows for collaborative documentation. Prior to 1.4.0, an Insecure Direct Object Reference (IDOR) vulnerability in the document rest… |
CVE-2026-4208 | High | 8.8 | 2026-03-17 | The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by… |
CVE-2025-69727 | Medium | 5.3 | 2026-03-16 | An Incorrect Access Control vulnerability exists in INDEX-EDUCATION PRONOTE prior to 2025.2.8. The affected components (index.js and composeUrlImgPhotoIndividu… |
CVE-2026-4171 | Medium | 6.3 | 2026-03-16 | A security vulnerability has been detected in CodeGenieApp serverless-express up to 4.17.1. Affected by this issue is some unknown functionality of the file ex… |
CVE-2026-3020 | | 2026-03-16 | Identity based authorization bypass vulnerability (IDOR) that allows an attacker to modify the data of a legitimate user account, such as changing the victim's… | |
CVE-2026-2461 | Medium | 4.3 | 2026-03-16 | Mattermost Plugins versions <=11.3 11.0.3 11.2.2 10.10.11.0 fail to implement authorisation checks on comment block modifications, which allows an authorised a… |
CVE-2026-1947 | High | 7.5 | 2026-03-16 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including… |
CVE-2026-1883 | Medium | 4.3 | 2026-03-16 | The Wicked Folders – Folder Organizer for Pages, Posts, and Custom Post Types plugin for WordPress is vulnerable to Insecure Direct Object Reference in all ver… |
CVE-2017-20223 | Critical | 9.8 | 2026-03-16 | Telesquare SKT LTE Router SDT-CS3B1 firmware version 1.2.0 contains an insecure direct object reference vulnerability that allows attackers to bypass authoriza… |
CVE-2016-20033 | High | 7.8 | 2026-03-16 | Wowza Streaming Engine 4.5.0 contains a local privilege escalation vulnerability that allows authenticated users to escalate privileges by replacing executable… |
CVE-2026-3999 | High | 8.8 | 2026-03-13 | A broken access control may allow an authenticated user to perform a horizontal privilege escalation. The vulnerability only impacts specific configurations. |
CVE-2026-2888 | Medium | 5.3 | 2026-03-13 | The Formidable Forms plugin for WordPress is vulnerable to an authorization bypass through user-controlled key in all versions up to, and including, 6.28. This… |
CVE-2026-2879 | Medium | 5.4 | 2026-03-13 | The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2. This is due to missing validat… |
CVE-2026-2257 | Medium | 6.4 | 2026-03-13 | The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2 due to missing validation on a… |
CVE-2026-1704 | Medium | 4.3 | 2026-03-13 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all ve… |
CVE-2026-2366 | Low | 3.1 | 2026-03-12 | A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative… |
CVE-2026-32131 | High | 7.7 | 2026-03-11 | ZITADEL is an open source identity management platform. Prior to 3.4.8 and 4.12.2, a vulnerability in Zitadel's Management API has been reported, which allowed… |
CVE-2026-27591 | Critical | 9.9 | 2026-03-11 | Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.0.477, 1.1.12, and 1.2.12, Winter CMS allowed auth… |
CVE-2026-32104 | Medium | 5.4 | 2026-03-11 | StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint accepts a user ID f… |